Between February and March of 2022, hackers shut down operations at 14 Kojima Industries plants, a major supplier to Toyota, causing a 5% dip in the company’s monthly productions. Eleven days later, hackers infiltrated two more Toyota suppliers, Denso and Bridgestone. The repercussions rippled across the industry.
Of course, it’s not only the automotive industry experiencing attacks. In April 2022, Costa Rica became the first nation to declare a national emergency due to a cyberattack. While stories like these make headlines worldwide, small and midsize companies have also been affected by cyberattacks, and manufacturers are prime targets.
According to one study, 55% of manufacturers experienced a cyberattack in 2021, and these numbers are on the rise. Midsize manufacturers should be especially vigilant, as they are big enough to be a profitable target but small enough that hackers may find them to be easier targets with fewer security measures in place.
Why on-premises software solutions are the wrong reaction to cyberattacks
Stories and statistics like these have struck fear in many manufacturers. One natural reaction is to move all software to an on-premises model and try to turn a factory into a miniature Fort Knox. The logic goes, “If systems are on the cloud, they can be accessed from anywhere. Therefore, they must be more vulnerable.” However, this is similar to reacting to theft by hiding all of your money under the mattress rather than in the bank. After all, anyone can walk into a bank.
Of course, money is much safer in a bank than under a mattress, and the same is true for data. Just as banks are equipped with state-of-the-art security, so too is modern cloud-based architecture. For manufacturers worried about cybersecurity, the solution is to adopt modern, cloud-based technologies that have been designed with security in mind.
Three elements of cybersecurity for midsize manufacturers
When it comes to cybersecurity, there are three primary considerations:
- Confidentiality: protecting information from unauthorized access and disclosure
- Integrity: protecting information from unauthorized modification
- Availability: preventing disruption in how to access information
On the surface, this appears straightforward, but looks can be deceiving. Manufacturers must make difficult decisions about information technology (IT) infrastructure and governance, balancing security with ease of use. Furthermore, cybersecurity is only as strong as its weakest link. Modern manufacturers juggle multiple software systems and industrial Internet of Things (IIoT)-enabled plant floor machines. Each of these make for potential access points. Not to mention, every employee is a link in the chain, too.
Factoring in all these concerns and the devastating impacts of failure, large manufacturers employ teams of cybersecurity professionals full of experts with diverse skill sets. However, midsize manufacturers can’t afford this. Instead, they need to rely on well-worn best practices for what they can handle in-house and partner with experts for what they can’t. With the cloud-based solutions that are a hallmark of smart manufacturing, outside experts can remotely monitor, detect and respond to cybersecurity threats.
Cybersecurity best practices for midsize manufacturers
1. Assess cyber maturity
Manufacturing is rapidly changing. As companies continue to see that industry 4.0 is the present and the future, they’re ushering in the age of smart factories. These changes bring better productivity, higher quality products and drive down costs. There’s no avoiding the change, but industry 4.0 brings new security challenges. As manufacturers transition to smart manufacturing, they should perform a cybersecurity maturity assessment to get a clear picture of their current risks. This should include evaluating personnel risks and technology risks.
On the personnel side, the assessment should involve conducting background checks for employees, identifying who should have access to your business information and aligning roles with access so that employees can only access the information and systems that their role requires. Furthermore, this should include processes for onboarding and offboarding employees.
On the technology side, the assessment should cover current practices for installing security patches and software updates, the extent of software and hardware firewalls, as well as web email filters. Finally, it’s critical to gain visibility on all access points to the company networks to have a comprehensive view of threat vulnerabilities.
2. Create a culture of security
Cybersecurity cannot be an initiative that only a few people on the IT team care about; it requires everyone. Today, many ransomware attacks start with simple phishing emails. One person clicking on the wrong link can lead to hackers gaining access to an organization’s intellectual property, locking employees out of their systems or even shutting down operations by accessing operational technology (OT) devices.
As with many things, an ounce of prevention is worth a pound of cure, if not more. Sometimes, stopping hackers in their tracks is as simple as teaching employees how to spot and report fraudulent emails. While midsize manufacturers might be tempted to think they don’t have time for a two-hour training on cybersecurity, they certainly don’t have time for their plants to be held hostage for weeks.
3. Unify IT and OT security
For years, IT and OT have been treated separately in all things, cybersecurity included. However, digitalization is driving greater interconnectivity, and the lines are blurring. As OT solutions move to the cloud, they’re more accessible to threats, but OT security continues to lag. As a result, OT environments are in the crosshairs of attackers. The 2020 IBM X-Force Threat Intelligence Index reported an unprecedented 2,000% year-over-year increase in incidents targeting OT environments, such as critical infrastructure manufacturing.
The way forward involves unifying IT and OT security. If it requires two-factor authorization and directory authentication to access an IT device, similar measures should be taken for OT. Not just anyone should be able to stroll onto the factory floor and access OT devices. When designing a cybersecurity plan, or when working with an outside agency to do so, manufacturers should make sure IT and OT personnel have a voice at the table.
4. Embed security in the design
Too often, cybersecurity is an afterthought. Manufacturers start an Industry 4.0 initiative, carry it out and then realize they need a cybersecurity plan. However, at this point, their new system is in place. This makes things much more difficult.
Instead, cybersecurity should be part of the DNA of a smart factory. To do this, companies should evaluate their Industry 4.0 solution providers to see if they follow security-by-design principles, ensuring security is embedded in the solution. This should include role-based access and authentication for employees using any IT or OT system and limit communication to the workspace to maintain data confidentiality and integrity.
Furthermore, the provider should have a plan in place to protect from attacks during the transition. If the transition takes too long, this decreases data availability and can lead to greater vulnerability. Therefore, it’s key to partner with a company that can implement new technologies quickly, decreasing the window of time when data is unavailable and the company is more vulnerable to attack.
Safer, smarter practices for midsize manufacturers
Cyberattacks show no signs of slowing down, and as manufacturing continues its high-tech evolution, hackers will look for ways to exploit the industry through attacks. However, the industry is far from helpless. Even manufacturers with little in-house cybersecurity expertise can fight back by following industry best practices and adopting modern cloud-based architecture. Together, manufacturers and their technology partners can ensure a safer, smarter future for manufacturing.
Do you have experience and expertise with the topics mentioned in this article? You should consider contributing content to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
