Cybersecurity is more than a buzzword, and it’s likely something you’ve been hearing a lot about lately.
Cybersecurity is the art of protecting networks, devices, and data from unauthorized access or criminal use. Since computers were first created, there have been hackers trying to access your private information. And today these threats are only increasing as most of our daily lives rely on the internet—from our communication to transportation, medical records, shopping, work—the internet plays a large role in each of our daily lives. As such, a robust cybersecurity prevention plan for your company is a must. But knowing which threats exist and how to get started can be daunting.
Today’s attacks are highly sophisticated and targeted to do massive destruction to companies across all industries. But manufacturing is one industry that seems to have a big target on its back.
“The manufacturing industry has become a more attractive target for cyber threats in recent years due to several factors, including increased connectivity of equipment via the Internet of Things (IoT), vulnerabilities in operational technology (OT) devices, the increasing amount of data being made available from equipment, and a general lack of cybersecurity culture and awareness across the manufacturing supply chain,” says Andy Lomasky, IT director at PMMI, the Association for Packaging and Processing Technologies.
The danger is real, but before you can develop a plan to protect your company from a cyber attack, it’s helpful to know your biggest threat, and it may be simpler than you think.
Your biggest threat
While sophisticated attacks may be on the rise, the most successful and historical cyberattack is the most simple: Phishing. PMMI reports that almost 90% of cyber attacks are related to email phishing, which can also lead to ransomware. Consider that phishing rose over 200% over the past three years, and incidences of attacks like these are only growing.
“The biggest cybersecurity threat is phishing… everyone is going after end users,” says Andy Sitnik, IT manager at Schneider Packaging Equipment, a Pacteon Company.
The problem is that phishing attacks start out from a small and seemingly innocent act (an employee opening and clicking on a link they shouldn’t have). With phishing, hackers will send a fake email with just enough believable information to get someone to open it. For example, they may ask for a quote to build out a machine knowing that sales staff will likely respond. “They’ll send an email with a legit link to a big company that everyone knows… the link is valid and then it goes to another page, and that’s where the phishing is,” says Sitnik.
The goal of a phishing email is to gain information about you, steal money, or install malware on your device. The takeaway? Be suspicious of all unexpected emails. And up your training game as one of the biggest tools to protect and defend against cyberattacks is proper employee training.
“Training is big… all these problems are coming from the end user. We do cyber security training at the yearly training through our HR system; everyone must complete it,” says Sitnik. In addition to yearly training, one company (that wishes to be anonymous) is even contemplating a phishing simulator as part of its training plan to hone in on who within the company falls for the scam. Then, IT can determine further training sessions (and maybe different methods) to make sure these people don’t fall for the real thing.
If you find yourself in a position where you don’t have any cybersecurity training in place, it’s a good idea to get started. The first step is to go to your IT department, operations, or finance—whoever oversees the basic information technology part of the company—and start to create a plan. Next, find a platform to help you train employees on the topic of cybersecurity (there are a lot of options out there at different price points). Set up a training schedule (ideally more than once per year so it’s fresh in employees’ minds), and include a variety of tools like videos, short presentations, best practices, and even checklists to keep your employees interested and engaged. Aside from training, be sure you have the tools in place to prevent cyberattacks as well as a plan of action in the case of a real-life threat.
“Use a good antivirus program; they’re not all the same,” Sitnik explains,“and look for advanced features like encryption guard, device isolation, etc.” Another best practice: Don’t be in a rush, work slower, and take a step back. Ask yourself if this email is real. Were you expecting the company to reach out, does everything look legitimate? And then there’s another best practice: multi-factor authentication. A common word of advice to boost your personal or company cybersecurity is to turn on multi-factor authentication. Known as MFA, 2FA, two factor authentication, multi-factor authentication, and two step factor authentication, it refers to utilizing an extra step when logging into websites and applications to confirm your identity. This is key because attackers commonly exploit weak authentication processes. With MFA, two forms of identification will be required, like a pin number and a fingerprint.
Sitnik recommends using multi-factor authentication anywhere you can. Because if someone does end up releasing their username and password, at least the fall back is having multi-authentication as another level of security.
But remember that MFA only works if you opt to use it, so opt-in for everything at work (and at home for your own safety) for better security against cyberattacks.
Five ways to protect our industry
Manufacturing is at a unique time in history due to the massive increase of sophisticated technology used in many facilities and all along the supply chain. It’s this increase in technology that poses the biggest threat. “Now more than ever, it is critical for manufacturers to prioritize cybersecurity and to take proactive steps to protect their systems and data,” says Lomasky. According to Lomasky and his colleague Bryan Griffen, director of the OpX Leadership Network, there are five things to do today to protect yourself from cyber attacks and protect our industry:
1. Ensure that all your devices, operating systems, firmware, and software are patched and up to date, and all have an anti-virus or anti-malware tool that can detect sophisticated threats like ransomware deployed across your organization.
2. Implement access protections like multi-factor authentication on as many of your logins and accounts as possible. Make sure your passwords are long and complex to prevent them from being easily cracked. And remember to follow the rule of least privilege— only providing access to what employees need to get their jobs done.
3. Scan your network. Know what is on it and make sure you know how to configure it and protect it, especially those hidden devices on the manufacturing floor like wi-fi modems.
4. Back up everything that is important to your company operations and have a good IT disaster recovery and business continuity plan. Know where your backups are stored and test getting your data back before there’s an incident.
5. Train all your employees on what cybersecurity threats look like.
In the event of a cyber attack, call your IT leader or service provider right away. Don’t be afraid to get outside help if needed. Figure out how it happened so it won’t happen again. And if necessary, alert the FBI or law enforcement so they can track the attacker and stop them from their next attack.
 | IT specialist Andy Lomasky and OT specialist Bryan Griffen talk through the ways to prevent a cyber attack. |
Don’t be afraid to ask for help
It’s important to note that you’re never without help in the area of cybersecurity. There are plenty of third-party service providers, best practice guides, reporting, and even government aid to help you get started. Take for instance the Cybersecurity and Infrastructure Security Agency (CISA), the newest agency in the federal government, established in 2018. As America’s cyber defense agency and the national coordinator for critical infrastructure resiliency and security, CISA leads the national effort to understand, manage, and reduce risk to the cyber and physical infrastructure that Americans rely on each day.
“As the majority of our nation’s critical infrastructure is owned and operated by the private sector, operational collaboration is foundational to our efforts,” says Antonio Enriquez, CISA Region 5 Chief of Cybersecurity. “CISA works to connect partners to the resources, tools, and information that will help them fortify their security and resilience against current and emerging threats. CISA has both cyber and protective security advisors across the country that can assist the critical manufacturing sector navigate available CISA resources.”
To better assist the critical manufacturing sector in improving their overall cybersecurity positions, CISA published a critical manufacturing sector security guide, which includes information on threats and cybersecurity best practices.
In the meantime, remember that prevention is the best “medicine” to thwart a cyber attack, and your employees are your best defense. With proper training and protocols in place, and the knowledge of what to look out for, preventing your next attack may not be as complex as you once thought. But wherever you are, be sure to continue to educate yourself and your staff to stay up to date on the latest threats and the best prevention methods.
Advice from CISA
The Cybersecurity and Infrastructure Security Agency (CISA) shares some best practices for OEMs to consider as they up their cybersecurity prevention game, and the biggest reasons why it’s so important.
“In today’s ever increasingly digitized world, we face dynamic and evolving threats to critical infrastructure, including manufacturing, that underpins much of our daily lives,” says CISA's Enriquez. “Some of the top threats facing organizations include malware with the intent to disrupt, deny, or degrade the industrial control systems orchestrating the critical manufacturing sector; ransomware; phishing; improperly configured remote access; Industrial Internet of Things threats; advanced persistent threat attacks; intellectual property theft; and distributed denial of service attacks.”
Here are some best practices and action steps for organizations and individuals to consider:
· Recognize and report phishing: If a link looks a little off, think before you click. It could be an attempt to get sensitive information or install malware.
· Update your software: If you see a software update notification, act promptly. Better yet, turn on automatic updates.
· Use strong passwords: Use passwords that are long, unique, and randomly generated. Password managers can help generate and remember different, complex passwords for each of your accounts. A password manager can encrypt passwords securing them for you.
· Enable multi-factor authentication: You need more than a password to protect your online accounts, and enabling MFA makes you significantly less likely to get hacked.
Access the CISA Critical Manufacturing Sector Security Guide here: https://oemgo.to/cisasecurity
