Integrated risk management essential

August 2019 IT infrastructure, Security Services & Risk Management, Industrial (Industry)

With manufacturing focused intensively on innovation, combined with a reliance on connected networks and products, it is an industry that is highly vulnerable to cyberattacks. Yet, the manufacturing industry remains fragmented in its approach to managing cyber-related risks.

Charl Ueckermann.
Charl Ueckermann.

This is according to Charl Ueckermann, CEO at AVeS Cyber Security, who was on the Manufacturing Indaba’s panel of discussion at the Sandton Convention Centre in June; “For manufacturing companies, the focus has always been on production innovation, operational efficiencies, minimising downtime and keeping the lights on. Therefore, when it comes to technology infrastructures in the manufacturing industry, the availability of systems has always taken priority over integrity and confidentiality, which inherently made cyber risk the least of concerns. However, in modern manufacturing, where systems are connected to the Internet, integrity and confidentiality will start to play a bigger role. In most other industries, such as financial services, confidentiality and integrity of their technology systems are prioritised over availability already, making the management of cyber risks a key focus.

“Historically, IT and operational technologies (OT) in manufacturing have also been managed separately, within different departments with their own sets of vocabulary and structures. OT departments don’t generally have as much insight into cyber risks as IT and this, by default, means that OT tends to lag behind IT in this regard.

“Yet nowadays, cyber risks are no less for a manufacturing company to protect its data, intellectual property and trade secrets than for a bank to ensure the confidentiality of customer information and other sensitive data. In fact, a cyber breach on an OT system could present a life or death situation for a manufacturing business because the health and safety of workers are at risk, and machinery and processes may become unsafe.

“The good news is that there is no need to compromise and sacrifice confidentiality and integrity over availability. In modern manufacturing, cyber risks can be effectively managed with the correct setup of OT networks that continue streamlining their production efficiency and capacity.”

Know the status quo

He advises manufacturing companies to get a firmer grip on the devices used on their OT networks.

“Have a good picture of the status quo. You need clear visibility of your OT architecture and know what devices are being connected to it so that effective security mechanisms can be incorporated into that fabric. No unauthorised devices should be permitted onto the network. Do not make use of off-the-shelf Raspberry Pis for testing in a live, non-air-gapped network that is not physically isolated from the Internet. It is doable to prevent an attack as experienced by NASA in June 2019; according to Forbes magazine, an unauthorised Raspberry Pi that was connected to its JPL servers was targeted by hackers, who then moved laterally further into the NASA network, comments Ueckermann.1

He continues: “You also want to find the best practices around cybersecurity hardening on your Supervisory Control and Data Acquisition (scada) systems and engage with a specialist OT security provider to implement the correct software required to ensure that your manufacturing environment is well protected, without compromising machine uptime. Ideally, due to the potential health and safety risks in the event of a breach, you should obtain the services of an OT governance organisation to assist with creating or adjusting processes that are globally aligned.”

Assess before you spend

His advice to manufacturing companies is to perform an Industrial Cyber Security (ICS) assessment before making any rash investments in people or technologies. Such an assessment comprises of a vulnerability assessment and a penetration test of the current infrastructure to get an accurate view of the assets and architecture and understand the cyber risks.

“Once this has been done, a pragmatic ICS cyber risk roadmap needs to be developed to determine the risks and how these can be minimised, accepted or outsourced. Importantly, operational and production efficiencies, as well as capacity, should not be compromised. Cybersecurity can be built intelligently into the fabric of the production systems,” explains Ueckermann, adding that ongoing monitoring with appropriate tools and processes is imperative to ensuring a proactive and predictive approach to managing risks in industrial control environments over the long term.

He concludes: “Manufacturing companies can benefit from a two-pronged approach that encompasses both risk management and risk outsourcing in the form of cyber insurance. The company’s risk profile will determine the level of cover required. Companies could lower their cyber insurance costs by taking steps to improve their risk profile, for instance, by ensuring that security solutions are up-to-date and properly managed, and by practising good governance.

“Cyber risk management in modern manufacturing is still new to the industry, and manufacturing companies need to plan and implement effective strategies and appropriate tools to manage and offset cyber risks in their environments. A team with a deep skill-set and appropriate experience is needed to find solutions for specific environments and risk profiles.”

Reference:

1. Winder, D. (2019, June 20). NASA has been hacked. Retrieved from Forbes: www.forbes.com/sites/daveywinder/2019/06/20/confirmed-nasa-has-been-hacked/#2e99f18cdc62


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

24-hour emergency response for staff
August 2019 , News, Security Services & Risk Management
The FirstRand Group has partnered with PanicGuard to create a 24-hour emergency response programme for staff.

Read more...
Double dose of storage security
August 2019 , Products, IT infrastructure
The integration of InfiniBox and SafeNet KeySecure platforms brings data-at-rest encryption together with centralised logging, auditing capability.

Read more...
Keeping our changing environment secure
August 2019 , Editor's Choice, Security Services & Risk Management
For a crime to take place there needs to be a victim and a criminal who sees an opportunity. For a cybercrime to take place we need the same set of circumstances.

Read more...
The importance of real security risk assessments
August 2019, Sentinel Risk Management , Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)
Andy Lawler, MD, Sentinel Risk Management, says a security risk assessment is an onerous task, but is not something estates can consider optional or a luxury item anymore.

Read more...
Risk assessment or product placement?
August 2019, Technews Publishing, Alwinco, SMC - Security Management Consultants , Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)
Hi-tech security solutions asked a couple of experts to provide estate managers and security managers with some insights into what a ‘real’ risk assessment includes.

Read more...
How far are we really at with artificial intelligence?
August 2019, Axis Communications SA , Editor's Choice, CCTV, Surveillance & Remote Monitoring, IT infrastructure, Residential Estate (Industry)
Justin Ludik unpacks exactly how far AI has come and what it potentially can do for society and more importantly, surveillance.

Read more...
Residential security – caveat emptor
August 2019, Stafix , Integrated Solutions, Security Services & Risk Management
When it comes to improving your property’s security, make sure you take all the options into account as you build a layered approach to keeping people safe and assets secured.

Read more...
Ensuring your electric fence is compliant
August 2019, Stafix , Perimeter Security, Alarms & Intruder Detection, Security Services & Risk Management
A challenge facing both existing and potentially new perimeter electric fence installations is how to economically meet the legal requirements required in the SANS 10222-3:2016 standards document.

Read more...
Addressing risks by means of access control layout and design
August 2019 , Access Control & Identity Management, Security Services & Risk Management
In order to develop a suitable, practical and appropriate security system for any organisation, it is essential to first develop a master security and life safety plan strategy.

Read more...
Inundated with cyberattacks from all directions
August 2019 , Editor's Choice, Cyber Security, Security Services & Risk Management
IT managers are inundated with cyberattacks coming from all directions and are struggling to keep up due to a lack of security expertise, budget and up-to-date technology.

Read more...