A recent ransomware attack in the US that shut down a major oil pipeline to the East Coast has highlighted the severity and outcome of these types of attacks. An AP article covering the event said that Commerce Secretary Gina Raimondo pointed to ransomware attacks as “what businesses now have to worry about,” and that she will work “very vigorously” with the Department of Homeland Security to address the problem, calling it a top priority for the administration. “Unfortunately, these sorts of attacks are becoming more frequent,” she said on CBS’ “Face the Nation.” “We have to work in partnership with business to secure networks to defend ourselves against these attacks.”
While the first step in developing a cybersecurity plan is to analyze operations and find vulnerabilities, the second step is to properly segment networks, manage their access, and create and test a recovery plan. The third step is personnel training.
According to “2021 Cybersecurity: Assess Your Risk,” a new report from PMMI Business Intelligence, “The best cybersecurity plan is only as good as the individuals tasked with carrying it out. With this in mind, manufacturers will have to decide who they want to be responsible for establishing and maintaining cybersecurity practices. In addition to allocating responsibility, manufacturers should properly train all of their employees on cybersecurity best practices, returning to instruction regularly when protocols change and to refresh employee knowledge.”
Creating a dedicated team that focuses exclusively on cybersecurity may be a step to consider. In the past, many manufacturers relied on their IT department to manage all of their cybersecurity concerns, and this is still a common model. Thirty-two percent of companies interviewed stated that cybersecurity is another responsibility left to their IT department.
To get better cybersecurity results, companies have started creating dedicated departments or teams within the IT department that are responsible for cybersecurity. About 41% of organizations currently have a distinct IT security team with dedicated OT specialists – a model that facilitates cooperation between IT and OT while simultaneously ensuring that cybersecurity is a top priority.
Common decision makers for IT are IT business analysts, CIOs, and IT architects, while OT plant managers, COOs, and control engineers commonly handle OT issues. IT and OT often have competing priorities - while OT seeks to maximize uptime, IT best practices require frequent updates/ patches which can adversely impact production operations uptime. However, the majority of manufacturers interviewed said collaboration between IT and OT has led to more secure solutions such as separate networks.
While a dedicated cybersecurity team ensures that digital safety protocols stay top of mind and up to date, effectively implementing such protocols requires the cooperation and diligence of every employee. Consequently, it is essential that manufacturers thoroughly educate their employees on the necessity of cybersecurity, properly train them to follow protocols, and regularly retrain them with updated best practices.
Cybersecurity protocols need to be comprehensive to ensure that an operation is properly secured, and straightforward and manageable enough that employees will actually adhere to them regularly. Protocols should not be unnecessarily complicated, and they should not hamper daily work routines too much, or lapses in security will result as employees struggle to adapt. Said one Automation Director at a pharmaceutical company, “Employees can be the ‘wildcard,’ training and retraining are critical for people to obey rules and maintain awareness and compliance.”
Partner with an Expert
Many manufacturers already struggle with a general lack of labor and skills, and they may not have the resources available to form dedicated cybersecurity teams. Manufacturers may find significant value in choosing to partner with a third-party cybersecurity expert instead. There are many services available to the industry that assist with assessing vulnerabilities, implementing protocols, and training staff.
Check List of Expectations When Partnering with a Cyber Expert
Risk assessment
- Internal and external vulnerability
- Walk through policy and procedures
- Baseline score card
- Compliance expertise and support
Security analysis
- Firewall review
- Secure end points, like computers
- Mobile security: tablets, cell phones
- Remote monitoring
- Intrusion prevention system
Training
- Provide security infrastructure
- Employee training
- Tabletop mock incidents
Cyber insurance
- Continual security maintenance
- Incident response services
- Disaster recovery
Download this FREE report below.
Source: PMMI Business Intelligence, “2021 Cybersecurity: Assess Your Risk”
