With manufacturing cybersecurity threats on the rise, what should companies know about protecting their digital assets in the future? 

Risks to Security in Manufacturing

The number of ransomware incidents involving the manufacturing sector increased 156% between the first quarters of 2019 and 2020. Later in 2020, ransomware actors demanded $17 million from a laptop maker and $34 million from a Taiwanese electronics contract company.

Ransomware isn’t the only threat to manufacturing cybersecurity. Where there’s ransomware, there’s almost always phishing. One campaign that targeted manufacturers, among others, was part of a larger effort to target the COVID-19 vaccine cold chain.

The issue with both ransomware and phishing is digital attackers can use these threats to steal their victims’ data. Malicious actors could compromise a manufacturer’s customer database and leverage those details to conduct follow-up attacks, such as manufacturing data breaches. Or, they could establish a foothold within the network and use that access to scout it out. They could then choose to sell that opening to a competing group, criminal enterprise or nation-state actor. They also could use it to conduct an attack of their own that could compromise business processes.

 IT-OT Convergence’s Role in Security Risks 

What’s important to note is the impact that these manufacturing cybersecurity issues could have on a business. For years, the impact was minimal. Manufacturing and other industrial sectors had no need to connect their industrial control systems (ICS) to the internet. At that time, the web was still growing. What they needed to do was make sure the physical processes that those ICS were watching were available. So, they kept them offline and away from threats that were beginning to take form.

Now, most businesses have a digital presence. Manufacturing cybersecurity needs are no different. They want real-time data, so they can monitor the state of their physical processes. This helps them perform preventive maintenance on equipment and minimize downtime. In order to do this, operational technology (OT), of which ICS are a type and information technology, are brought together. Manufacturers are turning to the Industrial Internet of things (IIoT) as a means of using the IT side of things to gain crucial insights into the way their OT is functioning.

But, there’s a problem. Many OT assets aren’t equipped to defend against today’s threats. Some of those assets are decades-old legacy systems that use proprietary protocols to talk to one another. As such, they can’t easily receive remote updates unless the owners take them offline. But doing that threatens the uptime of their physical processes. This makes it difficult for businesses to keep these assets secure as they go online via the ongoing IT-OT convergence. No doubt this contributes to the growth of digital threats confronting the industry, as discussed above.

Best Practices To Adopt To Combat Security Risks

It’s possible to overcome the challenges posed by security issues in the manufacturing industry. Business leaders just need to bring IT and OT together with a bit of care.

  1. First leverage the C-suite to clarify the roles and responsibilities of both IT and OT teams. They can then use pilot programs and cultural exchanges to slowly begin fostering teamwork between IT and OT. Plus, they can teach teams to share their challenges, needs and viewpoints with one another.
  2. Augment defenses of your entire system by:
    • Take inventory of all of your devices. Use that to determine which assets are most important.
    • Segment your network in a way that cuts down on risk — to legacy systems most of all — but still allows IT and OT to work together. These segments then give teams smaller sections within which they can implement network access controls along with network monitoring in order to defend against ransomware, phishing and other digital threats.
    • Use vulnerability management to patch all of the security weaknesses you can without taking key industrial assets offline.

Through due diligence like this, manufacturing cybersecurity problems can be solved.

More from Risk Management

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…

Tech Stack Diversity: Security Benefits and Costs

If your remit protects the information technology estate, you might be tired of the constant fire drills and reminders of upcoming disruptions. The barrage from cybersecurity vendors claiming "we have the solution" is almost equally exhausting. Start here: there is no magic bullet cybersecurity solution. If there was, its inventor would be a gazillionaire and have a list of enemies miles long. However, well-stacked solutions can significantly reduce your risk posture. The key is to place dependability over dependence, reduce…

Moving at the Speed of Business — Challenging Our Assumptions About Cybersecurity

The traditional narrative for cybersecurity has been about limited visibility and operational constraints — not business opportunities. These conversations are grounded in various assumptions, such as limited budgets, scarce resources, skills being at a premium, the attack surface growing, and increased complexity. For years, conventional thinking has been that cybersecurity costs a lot, takes a long time, and is more of a cost center than an enabler of growth. In our upcoming paper, Prosper in the Cyber Economy, published by…