With succeeding industrial revolutions, ever greater powers have led to corresponding possibilities and risks. Mass production, well be fore an era of automation, helped arouse what seemed like an unlimited potential for global economic productivity, while spawning a new world of consumerism. At the same time, flawed processes or products could present novel hazards of immense magnitude to both workers and end-consumers. Chernobyl and Bhopal still remind. And the threats of external or internal sabotage are ever present.
Now, as businesses move to Industry 4.0 and leverage cloud data storage, the Internet of Things (IoT), or automation and artificial intelligence, the prospects of throwing a monkey wrench into the works can take on startling new dimensions. Cybersecurity and a host of related threats now join our manufacturing lexicon.
The hacking of financial institutions, retailers, health care organizations or governmental agencies has sadly become commonplace, with disruption of consumer, patient or citizen accounts and records, accompanied by the all-too-familiar ransomware payments. At the same time, today’s connected and digitally dependent automobiles and their complex data flows need their own cybersecurity, while the vulnerability and possible consequences of disrupting electrical grids, hydroelectric plants, energy pipelines or water treatment plants have become quite apparent.
Manufacturing joins the Threat Club
In fact, the “hacking” of today’s Industry 4.0 manufacturing plants, with their reliance on data connectivity and integrity, by sophisticated bad actors is already under way. The 2021 Global Threat Intelligence Report (GTIR)from NTT Ltd., a world-leading global technology services provider, pinpointed that the pandemic and global destabilization, along with greater remote access by workers, were helping hackers to target industries.
Regardless, as reported by ITPro.com, the GTIR revealed that the manufacturing, health care, and finance industries saw 300%, 200%, and 53%increases in worldwide attacks, respectively, with these top three sectors accounting for a combined 62% of all attacks in 2020, up from just 11% in2019. At the same time, the shift to remote working and workers accessing company infrastructure through client portals led to application-specific and web application attacks accounting for two-third of all attacks.
Verizon, in its 2022 Data Breach Investigations Report, takes a deeper dive into the manufacturing sector. Of 2,337 incidents (338 with confirmed data disclosure), system intrusion, basic web application attacks and social engineering represent 85% of all breaches. External threat actors, at88%, accounted for the great majority of breaches, with the actor motives primarily financial, at 88%. Overall, Verizon noted that “manufacturing continues to be a lucrative target for espionage, but is also increasingly being targeted by other criminals via the use of Denial of Service attacks, credential attacks and Ransomware.”
Also, of interest, Verizon reported that while System Intrusion and Basic Web Application Attacks were on the upswing from 2019-2021,Social Engineering attacks were on the decline.
The clear and present danger
Certainly, there is a broad range of possible cybersecurity risks for manufacturing enterprises, everything from financial attacks like IP theft, property theft and ransomware quests to those that cripple production like equipment sabotage, assaults on the production process or attacks on strategic suppliers. Add in the pandemic, which, as noted, put those supply chain issues, already of great concern in our manufacturing sector, front and center. What if someone could stymie the complex interconnections of vaccine production, whether to collect ransomware, thwart a competitor’s efforts or simply out of purposeless malevolence?
In 2017, Renault-Nissan experienced a notable cyberattack that stopped production at five plants located in England, France, Slovenia, Romania and India. Here, ransomware was the object of the attack. It is clear that both potential lone wolf or state actor villains abound in today’s industrial or geopolitical world, whether we are talking about just hamstringing a competitor or crippling a region of a nation.
Our modern manufacturing facilities are just as important and vulnerable as an electric grid or water supply.
And beyond having a dedicated IT team focused on employing the latest weapons against cyberattacks, it is essential not to neglect the human element, including:
— Careful hiring processes
— Thorough risk assessment and crisis prevention and response
— Solid training in the systems and procedures designed to maintain cybersecurity
All of this must be backed by an organizational culture that embodies the solidarity and human behaviors that are, ultimately, the first and last lines of cybersecurity defense.
