Cybersecurity has quickly become a top challenge for manufacturers and industrial services around the world. According to a September 2021 survey of manufacturing executives, 61 percent identify cybersecurity as a “high/very high priority.”
These challenges are especially pronounced as manufacturers turn to remote and hybrid teams to attract and retain top talent while maintaining operational continuity.
As a result, manufacturers are introducing remote operations capacity for OT systems, allowing employees, contractors, and trusted third parties to operate on-site infrastructure from anywhere in the world. While the benefits are multifaceted, the risks to critical systems are real. Off-site workers are more likely to compromise OT integrity as everything from phishing scams to distractions undermine cybersecurity initiatives.
Unfortunately, many organizations do not have proper access control protection in place. Many manufacturing organizations still rely on antiquated control systems for their critical operations. At the same time, one industry report found that nearly half of organizations cannot identify a breach, and 25 percent haven’t audited their cybersecurity practices in the past year.
Manufacturers need to evaluate cybersecurity practices and address operational risks to their critical OT assets as soon as possible. For c-suite executives, cybersecurity managers, and other decision-makers, here are three best practices for improving OT security in this transformational time.
#1 Prepare hybrid employees
As manufacturers expand remote operations, they potentially introduce new vulnerabilities to OT assets.
Off-site workers frequently utilize company laptops and tablets for use, which could unwittingly open an attack vector for access OT assets especially if data protocols are not isolated to the OT network. In addition, limited budgets and a lack of user training can undermine cybersecurity priorities.
One study found that 61 percent of participants could not pass a basic cybersecurity quiz, underscoring the need for manufacturers to account for hybrid work realities.
In other words, cybersecurity starts with preparing hybrid teams to meet the moment. While this will necessarily look different for every organization, manufacturers should ensure that their teams can:
- follow digital hygiene best practices
- identify respond to shifting threat trends
- access digital assets safely and securely.
Hybrid employees represent a significant cybersecurity vulnerability, but they can be transformed into an asset with the right preparation.
#2 Implement OT-specific cybersecurity solutions
As manufacturers transition to a hybrid workforce, many will be tempted to forklift existing IT infrastructure authentication and access control tools and duplicate it to protect OT assets. Threat actors are well aware that these technologies require dedicated cybersecurity professionals for vulnerability and threat detection and management. Since these enterprise cybersecurity resources are rarely available for monitoring OT systems, exploiting vulnerabilities in OT systems will continue to increase over time with potentially devastating consequences.
That’s why manufacturers must use simple OT-specific access control solutions, including granular role and time-based authorization controls that monitor employees, contractors, and third party access to OT assets.
Most importantly, manufacturers should turn to a zero-trust cybersecurity architecture that incorporates:
- HW token-based multi-factor authentication
- Protocol isolation
- Mediated unidirectional secure file transfer
- Moderated “wait lobby” for user-to-asset access
- User-to-asset connection monitoring
- Full user access logging and session recording.
OT operational capacity comes with unique cybersecurity risks that require OT-specific solutions. Manufacturers are positioned to radically reduce risks to their operations and also realize operational efficiencies when they implement these solutions.
#3 Turn to automation
Attracting and retaining top cybersecurity talent is exceedingly challenging right now. There are more than 465,000 unfilled cybersecurity jobs in the US. Meanwhile, burnout and exhaustion are endemic among cybersecurity personnel, meaning even hirable talent may be less effective at securing a company’s digital landscape.
Automation technologies can help lessen the burden with regards to protecting OT assets. For example, modern threat management tools integrated with access control and monitor and effectively manage access to critical OT assets based on risk profile.
Securing OT empowers hybrid teams
Hybrid work is here to stay. As the World Economic Forum reports, “The industrial companies that take bold action to shore up their workforce and technology investments will emerge more resilient, and more likely to succeed no matter what uncertainties come their way.”
However, the convergence of IT and OT can provide threat actors with access to OT networks, so manufacturers need to update their defensive posture to account for these changing risks. Those that adapt quickly are best positioned to provide a safe, secure, and efficient operational environment.
