5 Cybersecurity Tips for Manufacturers that Will Prevent Expensive Downtime

I’m not sure congratulations are in order here, but during the second quarter of 2017 manufacturers attained the number one spot becoming the top targeted sector for cyber-attacks. According to the US National Center for Manufacturing Sciences (NCMS), 39% of all cyber-attacks in 2016 were against the manufacturing industry. Since the beginning of 2017 attacks increased by 24% catapulting the manufacturing industry ahead of healthcare as the most sought-after victim by today’s sophisticated digital criminals.

If this comes as a surprise to you, keep reading it gets worse. According to the National Institute of Standards and Technology (NIST), the cost to overcome a security breach the fiscal impact to large operations climbing as high as $10 million. How did the manufacturing world earn this honor? Simply put, cybersecurity for manufacturers has not been a priority and the hackers know it. Cyber-criminals always take the path of least resistance and greatest payoff, corporations with loose security and sloppy technical infrastructure are like painting a giant bullseye and expecting them not to point their rifles and shoot.

Since the industrial revolution manufacturers have long been admired for their strong focus on internal process, quality control, and efficiency, but when it comes to cybersecurity the internal focus may have blinded companies to the very real and potentially devastating external threats growing more sophisticated every day. Making this sector even more tempting, manufacturers are often viewed as easy entry points into larger businesses and government agencies, the ultimate payday for hackers.

The implementation of industrial control systems (ICS), centralized command centers that control and connect processes and machines, and the Internet of Things (IoT) external device integration like cameras and robotics, add multiple access points to the process with possible wormholes to infiltrate larger networks. As more manufacturing operations integrate via industrial control systems which connect their enterprise IT system and the internet, they are increasingly exposed to cyber-attacks that can result in production downtime, defective products, loss of intellectual property, physical damage, and even threaten lives.

Although it may seem overwhelming, hackers favor many of the same strategies repeatedly, with their greatest skill by far being tenacity. They’ll keep testing boundaries until a teeny hole is found and then quietly burrow deep into your network until the buried treasure is discovered.

Infiltration tactics most frequently used by hackers

Phishing efforts to test the strength of your company’s network and employee vulnerability. Phishing accounts for 67% of malware deliveries across all industries. Attempts are typically sent via employee emails and fake software update messages in hopes employees will click on links resulting in malware installs.
Embedding viruses and monitoring malware in email attachments sent to employees. Many emails look to be from real colleagues and external vendors and can be easy to fall prey to.
Malware downloads from websites. Often phishing efforts include links to legit-looking websites, so the employee feels safer downloading than from an email.
Use of company email addresses or social media posing as superiors to gain network or system administrator privileges or to blackmail employees.

You may be asking what exactly are cyber-criminals after? Great question, the more you understand their motivation the better to protect yourself and the organization from costly incidents. The simple answer is any morsel of data to make them money by any means. These include employee and customer records such as emails, financial accounts, passwords, or other helpful data to assist with identity theft. Banking and financial data for your company including banks, account numbers, authorized account holders, and passwords are also common targets. Access to lock network files which they can then charge the company a ransom to unlock. ICS system admittance to steal proprietary intellectual property for resale to your competitors or again to lock for blackmail ransom. Access to any internal systems or data to cause production line disruption creating havoc, to divert IT attention elsewhere, thereby freeing the hackers to infiltrate other parts of your network unnoticed.

The silver lining of this dreary cloud is that 90% of attacks are preventable. To ensure your company isn’t the next victim secure a managed IT provider with extensive expertise in total network security, ransomware protection, and backup and disaster recovery solutions. Even if you have a top-notch internal IT team it pays to bring in cybersecurity experts for manufacturers to conduct audits, develop strong protection protocols, and create effective employee training programs. The hackers are way ahead of you, don’t tackle this complex path on your own.

5 Cybersecurity Tips for Manufacturers to Prevent Expensive Downtime

Keep your network operating system and software up-to-date

Ensure network and software updates are current for all users, validate that anti-virus licenses are current and set to install real-time updates, implement spam blockers, and verify the strength of your firewall. Install malware-detection software on all devices. Required scheduled maintenance is preferred making it less likely your company will fall prey to workers that ignore repeat desktop update alerts.

Conduct password audits and create two-step login verification for all users

Employees and their passwords are one of your greatest security risks. Reduce your risk by conducting a user password strength audit; force the reset of any weak passwords identified. Work with your managed IT provider to implement a two-step user verification login process reducing the chance employees will share or guess each other’s passwords. It’s estimated that up to 73% of employees have shared passwords at some point. Add an automatic logoff process which logs users out after a specified time frame preventing other employees from working under the wrong user.

Implement an employee cybersecurity for manufacturers training initiative

The least technical step, training employees in cybersecurity awareness and impact to the business (which also means their jobs) has the greatest payoff for your company. Require new and existing employees to participate in cybersecurity education for manufacturers covering phishing attacks, what malware is, how to recognize acceptable email links and attachments, how to spot imposters, identifying fishy websites, and what to do if they may have compromised the company in some way. Repeat training at least once a year to keep it fresh. Stage mock attacks on a regular basis to see how well your employees practice what they learn.

Backup critical files on a daily basis

To avoid the awful experience of extortion by ransomware, backup critical files and software away from your main corporate servers and not linked in any way to your main network. If possible, encrypt data so even if accessed by a hacker they can’t read or utilize the data for dark purposes.

Develop and document a cyber-attack recovery plan for your organization

Create a recovery plan outlining what to do, who to inform, and action steps to take in the event of a cyberattack. Speed is critical during an attack, teams who can shut down hacker access quickly reduce downtime and impact to the organization. Walk through the plan with all employees as part of their training. Remember, backup files won’t help if there is no plan in place to restore operations and knowledge of how long it will take to execute. Make sure file back-ups are a part of your plan.

Now is the time to invest in cybersecurity for manufacturing to protect your operation against extortion and infrastructure vulnerabilities. Even if you have an in-house technical staff consider engaging an IT vendor that offers Cybersecurity for Manufacturers Defense Strategies to deliver experienced resources to guide your company into the unknown future and bring you peace of mind.