Businesses in all industries face an ever-increasing range of cybersecurity risks. This includes companies in the manufacturing sector. When you look at regulated industries such as pharmaceutical and medical device manufacturing, where patient safety is a top priority, cybersecurity risk levels can be even higher.
Industry 4.0 technologies and solutions almost always modify existing risks or create new ones. As a result, it is essential that cybersecurity is prioritised throughout every stage of every project that comes under the umbrella of Industry 4.0, digital transformation, smart manufacturing, and industrial automation.
It is also important to take a step back to take a wider view of cybersecurity in your organisation. This is because of one of the unintended consequences of Industry 4.0 technologies and solutions – the increased attack surface.
What is the Increased Attack Surface?
Some of the objectives of Industry 4.0 technologies include integration and the deepening of connections between systems. This can be systems on the production line, within the supply chain, or in other parts of the organisation, i.e., sales, R&D, purchasing, accounting, etc.
Even systems that previously operated in silos can be brought into the new connected structure to make better use of data and to make efficiency savings and productivity gains.
However, each integration step you take on your smart manufacturing journey increases the cybersecurity attack surface that exists in your organisation. The same applies to every new connected device, platform, or piece of equipment. Connecting to cloud services and other resources external to the organisation significantly increases the attack surface too.
In other words, each new system or machine you integrate or connect is another potential target of attack.
You might even have legacy systems that were never designed to deal with the cybersecurity challenges that currently exist, never mind those that are yet to emerge.
Secure IT is Not Secure Enough in the Smart Manufacturing Era
One of the key cybersecurity challenges as manufacturers transition to smart factories is the fact that IT and OT (operational technology) are not synced up in terms of cybersecurity.
This situation arises because the team responsible for IT security is likely to have limited input in OT decisions and processes, plus there is generally no equivalent OT team responsible for security. In many situations, this can leave organisations unprepared for the enhanced cybersecurity threat created by the increased attack surface.
Dealing with These Enhanced Cybersecurity Threats in Smart Factories
The Industry 4.0 concept of integration is a crucial part of the solution to the cybersecurity risks created by expanding attack surfaces. We are not talking about integrating systems or equipment, however, but teams.
In practice, this means approaching cybersecurity in a more holistic way across all parts of the organisation, taking into account both IT and OT.
This integrated approach to cybersecurity will mitigate the threat of the increasing attack surface. For example, dealing with the gaps that arise in maturity assessments.
Cybersecurity maturity assessments are typically performed periodically. The time between assessments can often be too long, but there is also the issue of new Industry 4.0 solutions being implemented between cybersecurity maturity assessments. These solutions can increase the attack surface further, increasing risks and rendering the assessment out of date even though it is the most recent.
Taking a Holistic Approach to Cybersecurity in Manufacturing Organisations
While integrating your cybersecurity team across IT and OT is the solution, that team will require detailed knowledge of existing and emerging cybersecurity threats. It will also need in-depth knowledge of both IT and OT assets and network architectures, in addition to knowledge of both business and manufacturing processes.
Taking a holistic approach to cybersecurity also involves real-time auditing of IT and OT assets, regular maturity assessments and risk reviews, taking mitigating actions, and continuous monitoring.
While this is a more expansive approach to cybersecurity than currently exists in many manufacturing organisations, it will ensure the maximum level of protection across the entirety of the potential attack surface.
