The importance of cybersecurity in manufacturing
Does this sound like you?
After intense negotiations with dozens of vendors, grueling engineering discussions with the production team, painful budget approvals, and months of redrawing the assembly lines, you moved your semi-automated production process into something contemporary. Your modern world-class manufacturing line is now a text-book case of how a connected Industry IoT plant should look: you have robotized processes, IoT asset management, automated vendor plug-ins, remote monitoring and control of most production routines, vision managed defect assessment, and a holistic view of how your other plants halfway around the world are functioning -all in a single screen, with a few clicks.
Now that you have slashed defect rate cut down human intervention, and improved production rate, you think you have got it all figured out and can take that over-due holiday on the beach? Right?
Wrong.
Sorry to be dramatic. But this is what the cyber bots are heard saying: “Thank you for creating a fertile territory for us to proliferate. We couldn’t be luckier”.
Speed is only half the battle in IIoT
The ‘Floating assembly lines’ of industrial revolution 4.0 are designed to meet demand in the shortest time possible. Approved supplier systems automatically log in and ship components to a live assembly line to meet the production targets of an OEM producer. Most of these decisions are made by systems using a variety of software (AI, IoT hub, decision algorithms), learning systems (M2M), networking (IR, 5G NR. Cloud computing), and production systems (3D printing).
Consider the possibility that a supplier’s system is infected with malware and enters this system. It could proliferate the OEM supply chain, other supplier systems, and respective corporate IT infrastructure in minutes. The potential for damage is even more significant if, by some means, it mutates and destroys safety mechanisms in the plant and endangers human lives.
According to the Deloitte and Manufacturers Alliance for Productivity and Innovation (MAPI) study, 48% of surveyed manufacturers fear that cyber attack is a real threat and the greatest danger they envisage for smart factories. And damage due to a cyber incident in manufacturing was estimated to be about $330K.
Disconnected islands in a sea of connectivity
The single biggest threat appears to come from here: Operational Tech (OT) and Information Tech (IT) systems do not talk to each other. OT refers to hardware and software used to change, monitor, or control physical devices or processes within a production facility.
Traditionally, manufacturing systems have been proprietary with few, if any, open standards for third-party plug-ins.
Tightly coupled legacy systems become a natural barrier for easy upgrades imposing change-impact study for every minor upgrade. Security controls for such systems are vendor-driven patches that are slow to come by. Also, vendors of traditional manufacturing systems do not cover OT in service agreements and maintenance contracts. The IT team simply believes that ‘all is well as they focus on the rest of corporate ERP, DB, networking, and productivity systems.
Some important cyber security considerations for the manufacturing facility are detailed below:
- Solution Design: Restrict device and system access to authorized personnel only. Ensure cloud or network access follows rules-based access control.
- Access & Authorisation: Ensure default passwords are changed in all IIoT devices, the new passwords conform to IT Security policy, and access control of edge devices is regulated. Default password vulnerabilities in 3rd party connected devices are a leading cause of security vulnerability.
- Production Planning: Ensure company-wide secure remote access policy is defined, followed, and documented. Ensure cyber intelligence information exchange, record incidents, document phishing attempts, and develop thwart methods.
- New Technologies: 3D printing and enhancements to the existing production line should be zoned separately with one-step isolation. For network 3D printers, it may be required to run separate cyber assessment tests and share reports with corporate IT security teams.
- RPA, ML, NLP, and AI: These new technologies have clear benefits on the shop floor but will bring in their threats. Deploy rigorous application whitelisting, access control, portable memory control (USB drives moving in and out), controlled access to the internet on such systems, and accurate real-time inventory management.
- Asset Management: Ensure security rules and policies are risk-based rather than compliance-based. Maintain a qualified, dedicated team to create surprises in addition to routine checks. This team should be aware of company-wide incidents and trained to observe seemingly unconnected events to extract real intelligence in a security scenario.
Since digital and cybersecurity elements will become all-pervasive sooner or later within corporates, it is a matter of time before they start impacting manufacturing processes.
Conduct a thorough cybersecurity assessment
This is an independent exercise and should not be downplayed in a regular corporate IT security audit. Ideally, the cyber assessment should be done every six months, including OT in the IIoT environment, recorded results, gaps plugged, shared with corporate IT and cybersecurity intelligence groups in the industry for mutual benefits.
It is also advised to build security protocols across the corporation, cover micro-assets and entry points for physical and digital products, and make sure the protocols are part of an overall security umbrella policy applicable to all branches and personnel.
In conclusion, remember that internal view often leads to fatigue derived from familiarity. It helps tap the rich experience of industry experts who have already done some of these things.
For example, at Trigent, our industrial security experts have delivered solutions in RPA (complementing human judgment with automation-led efficiency), predictive maintenance, and AR (Augmented Reality – helping find unique ways to connect humans and machines) for big and small manufacturers. Our clients across energy and oil, retail and manufacturing, healthcare, and education stand testimony to our capabilities.
Give us a call or drop us a line. We will be happy to help.
Author
