In December of 2016, a Ukrainian electricity grid went down. A large part of Kiev was blacked out during the attack. This was a follow-on attack from a 2015 cybersecurity incident against the Ukrainian grid, which affected 225,000. Cyber-attacks on industrial structures and critical infrastructures are no longer a theme from a movie, they are real and expected to become more frequent.
The Manufacturers Organisation, EEF, in a study into the impact of cybercrime across manufacturing in 2018, found that almost half of manufacturers have been a victim of a cybercrime.
In this article, we will look at some of the areas of manufacturing that are being affected by cybersecurity threats, what those threats are, and what can be done to protect our most critical of infrastructures.
Areas of Cybersecurity Concern
The manufacturing industry is going through a major shift where technology is being used to transform processes and systems. In the first industrial revolution of the 18th century, energy sources, like coal paved the way for new processes. Today, technology is transforming industry creating a fourth industrial revolution, or Industry 4.0. These technologies include Internet of Things (IoT), Big Data, robotics, and artificial intelligence. Industrial systems and control units (ICS) and SCADA, are no longer isolated from the wider world – they are connected in an effort to improve productivity and streamline industrial processes.
The connectivity ties together disparate and sometimes remote industrial units and systems. And, it is also being applied to the building of more technologically advanced supply chains. The Boston Consulting Group expect that the market for Industrial IoT (IIoT) will be worth $40 billion in 2020 within discrete manufacturing, including automated inventory.
It is the connection across industry that is opening the gateway for cybersecurity attacks:
Supply Chains: The IoT is expected to transform manufacturing supply chains. The IoT is improving vendor relationships by speeding up communications and acting as a conduit for the flow of data across the chain. Asset tracking using the IoT enables improvements in product management lifecycle. And, add on benefits such as inventory management, is helping to maximise efficiencies in manufacturing. But adding the IoT into supply chains also opens up gaps in security.
The IoT opens up a number of areas where cybersecurity can be exposed, including
- Distributed Denial of Service attacks (DDoS): the Mirai botnet attack of 2016, that brought large parts of the U.S. east coast Internet down, was enabled by Internet-connected video cameras.
- Data theft: The IoT collects, generates, and shares data. These data are under the same threats as any other data but the IoT is a highly distributed system – it is a bit like comparing a single hole funnel to a colander. You have to make sure every IoT device, and the access to those devices, is secured. In an extended supply chain, this can pose a challenge.
OT and IT merging: Operational Technology (OT) generally controls physical systems, whereas Information technology (IT) controls data flow. The advent of Industry 4.0 is seeing the convergence of OT with IT as operational technology uses IT operating systems like Unix and Windows. This is opening up manufacturing to the types of security threats normally only seen with traditional IT, including threats such as spear phishing and DDoS attacks.
A report by Kaspersky, which looked at the challenges that the merger of OT with IT poses found that one of the biggest issues was the lack of maturity of cybersecurity in places where OT had converged with IT. The report also found that three-quarters of respondents felt that they were likely to be a victim of a cybersecurity attack because of the merger of OT with IT.
Manufacturing company, Honeywell, looked at the specific threat level of the use of USB devices in an industrial setting. They found that 44 percent of tested devices contained at least one malicious file that could cause considerable damage to operations. Of these, one in six specifically targeted Industrial IoT devices.
Connected industrial systems: Industrial systems have been, until the advent of Industry 4.0, siloed. Industrial Control Systems (ICS) are part of the critical infrastructure of many manufacturing companies. Twenty types of cyberattack on ICS units have been documented by the U.S. government Computer Emergency Response Team (CERT). They include insider threats, ransomware, nation-state attacks, and supply chain compromise.
Tips to a Safer Manufacturing Industry
Manufacturing is entering a new era and with it comes increased threats to the infrastructure of the organisation. These threats are the same threats that all industries see, but the complexity that extended supply chains and highly connected critical infrastructures play, make the stakes soar. Here are some basic tips for making manufacturing more cyber-safe:
A Culture of Security: The entire organisation, including the vendor supply chain, needs to be highly aware of the security issues in modern manufacturing. A security awareness training program should be used to ensure all employees, including blue-collar and white-collar workers are knowledgeable about cybersecurity threats.
Phishing is as serious an issue in manufacturing as in any other industry. A security awareness training program should also include phishing simulation exercises to ensure that staff can spot a phishing attempt.
Supply chain management and security: Vendors are a potential chink in the armour of a manufacturer’s security. As well as ensuring they run their own security awareness campaigns, manufacturers should make sure that security policies are part of a vendor’s own security strategy.
Robust technology measures: Good security is part of a wider, multi-layer approach. Modern cybersecurity threats use any possible method to circumvent security. This includes human as well as technological. Augment the training of staff in security with good security measures. This should cover everything from security hygiene issues like password security to robust authentication to the use of recognised Cloud security measures and IoT protection.
Manufacturing a Secure Environment
The manufacturing industry is going through a digital transformation that will change the way we work forever. The changes in the IT infrastructure has opened up, once closed, systems, to the outside world and cybercrime. This is demonstrated in the EEF report which shows that manufacturing is the third most targeted industry for cybercrime. This industry sector needs to take a lesson out of the leaf of other sectors like financial and healthcare and ensure that the right structures, including education about cybersecurity, are in place.
© 2023 . The Defence Works. All rights reserved.