The Evolving Threat Landscape
The convergence of operational and information technology is leading the shift toward Industry 4.0. Organizations that previously relied on air-gapped environments (internal systems that do not connect to the internet and are only connected to each other) now want to leverage Industry 4.0 technology and the benefits that come with it including data analytics, proactive alerting, remote management, and much more.
These enhanced capabilities provide the insights that allow companies to remain globally competitive. However, for every new connected endpoint an organization chooses to adopt, a new potential vulnerability becomes present. Threat actors can intercept these endpoints in a variety of ways, including by hijacking the flow of data that runs between these endpoints.
The financial, reputational, and technical costs of these attacks can easily drive a company out of business. According to the United States Securities and Exchange Commission (SEC), 60% of small and medium enterprises close within 6 months of being hacked. The cost of these breaches continues to increase, with the average global cost of a single breach hovering at $3.62million USD.
Shields Up
In recognition of the expanding attack surface and amid globally rising tensions between nation-states, the American Cybersecurity & Infrastructure Security Agency (CISA) has issued new guidance for organizations of all size to take a “shields up” prevention posture.
Evolving intelligence indicates that foreign powers are planning, and have begun to execute, damaging cyberattacks. These attack shave a particular focus on infrastructure, manufacturing, and automation companies that are pivotal to the integrity of the supply chain. This heightened threat with the enhanced risk of adopting more connected technologies on the journey to Industry 4.0 should be a strong motivator to head CISA’s shields up directive. The pillars of this directive are centered around:
· Reducing the likelihood of a damaging cyber intrusion by keeping software updated, taking a zero-trust approach to network access, and adhering to CISA’s IT controls and cyber hygiene guidance.
· Taking steps to quickly detect a potential intrusion by training personnel on how to identify unusual network behavior and ensuring all connected network endpoints are protected.
· Ensuring the organization is prepared to respond if an intrusion occurs by designating a crisis-response team, assuring the availability of key personnel, and conducting frequent tabletop exercises.
· Maximizing the organization’s resilience to a destructive cyber incident by testing backup procedures and conducting tests of manual controls to ensure that critical function remain operable in the event of network unavailability.
The War on Talent
With the prediction that there will be over 3.5 million un filled cybersecurity roles globally by 2025,organizations must plan to win the war on talent if they have any hope of staying ahead of this curve and subsequently, staying ahead of threat actors.
Companies should be working now to build a sustainable talent pipeline for their current and growing cybersecurity needs. This work can be done through community collaborations with academic institutions, involvement in industry events, and supporting collisions spaces for students to obtain experiential learning opportunities that put bring their classroom skills to the workforce.
Simultaneously, organizations should be building proactive and robust vendor relationships with companies who can augment and supplement the internal security skills they lack. The importance of doing this early cannot be understated. Both from an attack prevention perspective and financial perspective, it is far more beneficial to have existing vendor relationship if an attack happens to avoid costly rapid response engagements that may not be able to minimize the fallout of a breach should it be too late in the attack chain.
Preparing for Industry 4.0
Overall, if organizations wish to remain globally competitive, the transition to Industry 4.0 will be an unavoidable undertaking. While there are significant risks to moving out of an air-gapped environment0, the benefit of modern technical, analytics, and insights is vital to business growth.
Companies need to be prepared to embrace this fourth industrial revolution with security solutions that meet the demands of the growing threat landscape. With the support of industry experts, leveraging the advice of the intelligence community, and proactively building relationships with talents and vendors, companies of all sizes can be prepared for what is to come.
