Many organisations are struggling to keep up with the changing security landscape. There is no time to relax as new threats are constantly appearing. The pace and scale at which security challenges intensify will only expand the threat landscape, and new technologies being adopted bring their own vulnerabilities.

The manufacturing industry is not immune from these threats. With the increased use of digital technologies in production plants, the importance of cyber security is growing. Therefore manufacturers need to be aware of the main enterprise security challenges and how to address them.

Navigating diverse environments in manufacturing

Manufacturing companies have a diverse technology environment. This presents the first challenge.

Manufacturers operate within a dynamic technological landscape, with systems that provide the operational backbone and others that are used to control production machinery. Some companies primarily use the cloud, others have everything on-premise, and another group operates a hybrid of the two.

Cloud systems are often used to provide high availability and to guarantee business continuity and disaster recovery. On-premise systems are usually retained because of the cost of upgrading software and infrastructure with the objective of increasing the life of the assets before they have to be replaced.

What can manufacturers do in this diverse, evolving IT environment?

1. Keep up-to-date with current IT security practices. This includes ensuring login credentials are protected with authentication methods like multi-factor authentication to protect applications and websites.
2. Educate employees on how to use authentication measures and to be vigilant as cybercriminals try to get around the measures and what employees should do in case of an attempted breach.
3. Make sure that all software is on the latest version. Companies tend to overlook this due to concerns regarding changes to the way the software might work in an always-on environment. Software companies these days have a strong focus on improving security and protection in each new version of software, so it is good security practice to upgrade to the latest version.

Threat landscape

The second challenge is the threat landscape. This is one of the biggest potential risks, people and businesses face online. It includes a range of cybersecurity risks, such as malware attacks, data breaches and theft of data. Just because a company is free from threats today doesn’t mean one won’t suddenly appear tomorrow.

One of the major threat areas comes from staff working remotely. They can inadvertently get exposed to a threat when away from work, but then once they come into work and are on the company network and inside the firewall, the organisation can be exposed.

Some systems do have known vulnerabilities that criminals try to exploit. Manufacturers should be aware of these vulnerabilities and take steps to secure them. Unfortunately in some instances, there are unknown vulnerabilities that can be used by cyber criminals.

Key steps that can be taken to address the threat landscape are:

1. Run a regular risk assessment. This involves reviewing policies and procedures regularly, at least quarterly.
2. Monitor network traffic because if there is a security compromise, there will most likely be a spike in traffic. Companies can identify a pattern of traffic tolerance levels and then take action when the levels are exceeded.
3. Communicate proactively to staff and look for ways this can be continually improved.

In terms of communication, manufacturers should also be aware of privacy regulation reporting obligations, such as GDPR and CCPA. There are 20 countries now that have comprehensive data privacy and reporting laws.

Human error

Human error is the third challenge and THE ONE which has led to some of the biggest system and data breaches. Whether through naivety, lack of knowledge, or clever use of psychological approaches, humans are often the weakest link when it comes to company security being breached.

Key steps to address this challenge:

1. Implement identity access management. Make sure access is controlled using technology like multi-factor authentication.
2. Have a system to monitor and protect access to company data. This is to restrict possible losses and unauthorised access, and if it does occur, will enable data to be recovered from backups.
3. Put vulnerability management into practice. This is the process of identifying, evaluating, and reporting security vulnerabilities in systems and software. When an incident occurs, companies need to work through the incident, determining the severity and data communication plan. After root cause analysis is performed to understand how the incident occurred, there needs to be continuous incremental improvement to ensure it doesn’t happen again.

As with all the challenges, there should be a focus on education and training to create awareness of what threats are around, and how clever the attacks can be.

Part 2 of this series will cover threats that manufacturers need to consider as they adopt smart manufacturing technology, the issue of supply chain threats, and how an ERP system can be used to protect the business and its data.