How to Increase and Improve Cybersecurity in Manufacturing

Propelled by the burgeoning equipment behind Industry 4.0, manufacturers have more advanced technologies at their disposal to streamline machinery functions, share enterprise information and — hopefully — increase outputs and profits.

Yet with these technological advances come increased cybersecurity risks for manufacturers — ones the industry is just beginning to awaken to.

Why We Need to Focus on Cybersecurity in Manufacturing

Secure manufacturing is a growing movement spurring smarter network, software, data and equipment defenses and policies deployed in the manufacturing industry.

There are several reasons why manufacturing network security has grown into one of today’s most critical risk-management strategies for manufacturers.

1. Interconnected Technology Has Increased Attack Surfaces

The Internet of Things (IoT) has inspired a network of more than 200 billion ever-connected devices in 2020 alone.

The manufacturing sector has seen rapid IoT-led innovations in technology such as assembly robots, 3D printing, computer-aided design and manufacturing (CAD/CAM), data filing and file management, automated pick-and-package bots and more. Experts expect the number of IoT-enhanced manufacturing equipment will double again by 2023.

All these devices motivate manufacturers to get serious about how they’re using and protecting them, alongside better usage education for employees.

2. Manufacturers Increasingly Store Targeted Data

Small and mid-sized manufacturers are particularly at risk for breach and hack attempts. In fact, over 50% of small and mid-sized companies have been a victim of a cyberattack in the past five years, with manufacturing one of the most targeted segments.

Such hack-prone data warehoused by manufacturers includes but isn’t limited to:

• Credit card information
• Bank accounts
• Routing numbers
• Protected health information

3. Others Have Beefed Up

Manufacturing is a critical infrastructure (CI) sector, considered one of the American economy’s primary industries and a driving player in world economic activity.

Yet unlike the majority of other industries considered CI, there are few federal cyber risk requirements and mandates specifically designed to secure the manufacturing industry.

This leaves glaring hole manufacturers can no longer ignore when the integrity of operations — and their organization’s reputation — sits exposed. What’s more, other countries are increasingly reforming how businesses can use and exchange data via today’s advanced technologies — with few examples more pertinent than 2016’s General Data Protection Regulation (GDPR), which is enforceable if U.S. manufacturers do business with European Union clients or manufacturing supply chain partners.

How to Increase Cybersecurity in Manufacturing

Cybercriminals target small and medium-sized manufacturers for two primary reasons:

• They typically provide a more accessible entry point to government networks.
• They’re a repository for personally identifiable information (PII) such as bank accounts, customer financial data and employee records.

With these top threats in mind, consider these steps and best practices to shield your advanced technologies and secure your data, supply chain, outputs — and existence.

1. Integrate OT and IT

Operational technology (OT) and information technology (IT) personnel in manufacturing companies are historically separate departments, with a lack of communication preventing a more coordinated security effort around floor machinery, smart equipment and the increasingly evolved software running them.

Rather than organized as separate functions on the same spectrum, OT and IT require departmental synthesis to ensure IT knows what’s happening on the floor while OT understands the technical parameters and limitations of smart equipment needs.

It’s also a good idea for your cohesive team to review cybersecurity insurance and analyze whether your policies comprehensively protect both sides of the secure-manufacturing spectrum while fitting your realistic risk vectors.

2. Re-Evaluate Your Equipment Under the New Dual Lens

A manufacturing equipment audit performed by IT and OT personnel provides visibility across your advanced technologies network.

A complete view of what equipment you support, who uses it, usage policies and cyber defense mechanisms in place helps sync your technical team’s undertakings.

More specifically, it can bridge previously uncoordinated activities that prevented contemporary cybersecurity defenses. For example, some industrial equipment cannot undergo a particular software update or patch because it voids the warranty. Without a complete audit, these holes would linger.

3.Deploy a Data Audit

Data audits prioritize your manufacturing organization’s operationally critical data.

These files are paramount to the end-to-end functionality of your business, from managing product digital prints and spec sheets to proprietary documents surrounding a product’s production process to warehouses of supply chain vendor information.

A successful data audit for manufacturers should review and prioritize the following according to operational vitality:

• Intellectual property files
• PII from your employees, customers and vendors
• Credit card and banking information
• Research and development files
• Protected health information

4. Bolster Data Storage Defenses

Have OT and IT develop a new, multi-phased plan to roll out deeper, tiered storage of your most critical data and files prioritized in your audit.

Updated storage and defenses apply the most pertinent security measures for a given piece of equipment, software or data warehouse. Yet even more importantly, it rejects a “one-size-fits-all” approach to manufacturing cybersecurity defenses that hackers historically manipulate.

With proper defenses designed specifically for a device or application, cybercriminals cannot breach the vulnerabilities of one technology to extract information from the whole, preventing production downtimes, expensive repairs and possible regulatory ramifications.

5. Segment and Enforce Network Authentications

Segmenting networks is one of the best ways to separate a manufacturer’s priority data and files away from less-critical applications or functions, as well as tailor more specific defenses to each subsequent network segment.

With segmenting, a manufacturer breaks its enterprise network into a series of smaller ones called subnets. Subnets can then be individually controlled and managed, allowing for:

• Granular network traffic controls
• Individualized network authentications and user-access IDs
• Faster threat detection capabilities, identifying the attacked network sooner
• Streamlined audits performed on a network-by-network basis

6. Review External Partner and Vendor Processes

Vendor security reviews are more instrumental than ever to patch cyber risks for manufacturing.

This includes but isn’t limited to auditing the storage and exchange of information with any of the following parties your organization works with, namely:

• Subvendors
• Supply chain logistics providers
• Cloud hosts
• Co-located data centers
• Any other outsourced resources

Consider drafting new vendor communication protocols and educating employees on these new methods to send, share, read and file vendor documents and transactions. OT and IT teams may even want to explore updated vendor portals where these transactions can occur, adding a further layer of protection and modern IT infrastructure management.

These protocols should also be shared with all appropriate vendors, ensuring operational transparency and proving your dedication to cybersecurity diligence.

Step Up Your Cybersecurity With MANTEC

Take your organization’s cybersecurity risk management into your own hands.

MANTEC is one of Pennsylvania’s leading manufacturing consultants helping small-, mid- and large-sized enterprises alike navigate industry trends to come out stronger, leaner, more competitive and more profitable.

Learn more about MANTEC’s cybersecurity in manufacturing programs and consultations, including the latest in NIST regulations.