Manufacturing Industry

Cyber Security Challenges in Manufacturing

Industry 4.0 has its benefits, from increased automation, process improvements and new levels of efficiencies, it can also expose critical OT to security vulnerabilities, while presenting new windows of opportunity for cybercriminals.

Health Benefits For Veterans

Traditionally, cyber security was not a critical consideration because a manufacturer’s OT environments were designed to be isolated, communicating via proprietary industrial protocols and operated via custom hardware and software. Those traditional systems had limited exposure, whereas, today, OT environments have converged with mainstream technologies and are often no longer air-gapped from IT networks, meaning that the lack of adequate security measures poses a critical risk.

This evolution has not gone unnoticed by threat actors. Industrial Control System (ICS) and OT-specific malware such as Industroyer, Triton and Incontroller are evidence of the increasingly sophisticated capabilities that attackers have begun to deploy, resulting in serious incidents.

Situational Awareness

An expansive and growing attack surface, arising from convergence, connectivity, geographic and organisational complexity, combined with a general lack of cyber security risk management is increasing risk exposure. By connecting OT to IoT and IT devices, vulnerabilities that once were seen as insignificant due to the lack of external connectivity are now high targets for bad actors. On top of dealing with increasing attack surface, other factors like systems obsolescence and a general lack of OT cyber awareness amongst the workforce are compounding matters.

Manufacturing Risk Management

In the context of an organisation with no or limited OT cyber security risk management, CNB Tel recommends a holistic approach when defining an effective OT cyber security risk management strategy/programme.

The first step in this journey is to understand risk and consequences to the organisation. At a basic level, this means identifying the most critical OT functions essential to fulfilling the organisation’s business operations, and the potential consequences of a cyber attack against them. The knowledge of an organisation’s system custodians and engineers should be leveraged to identify methods an adversary could use to compromise critical OT functions. This valuable knowledge includes technical system architecture details, procedural and ways of working insights, like logical user access, third-party service provider scope, supply chain considerations, physical security etc. Real-world cyber scenarios seen across industries should be considered, of course, not all will be applicable, but to ensure completeness and due diligence they should be considered.

The ultimate aim of this initial analysis is to identify and prioritise risks that result in high-consequence events for the organisation. It also provides a high-level snapshot of current risk exposure and whether this exposure is within or out of organisational risk appetite/tolerance. Any subsequent OT cyber security strategy/programme and risk mitigations should be aligned accordingly with this analysis to ensure tangible risk reduction that is outcome focused. This approach helps organisations justify OT cyber security improvements and the associated costs by being armed with better information and understanding of “What, Why and How?”

Call to Action

Operating a Manufacturing asset without an appropriate OT cyber security strategy/programme and relevant controls is high risk. To help you discover your level of risk exposure and to illustrate how we can support effective OT cyber security return on investment, get in touch for a free 30-min consultation.