4 Common Cybersecurity Threats to the Manufacturing Industry

In this digital age, manufacturing companies are key targets for cybersecurity attacks from all quarters. The types of attack may be understood by the methods used — malware, phishing, database infiltration — but the types of threats can also be categorized by their sources. The vulnerabilities may be compounded during times of crisis, such as the current COVID-19 scare. An increase in remote access connectivity — if not executed properly — can create additional exposure for susceptible networks. Here are four potential threats to the manufacturing industry classified by origin.

Insider Threats to Cybersecurity in Manufacturing

While they may be rare, the potential for data loss due to employee theft or sabotage is tremendous. A major national intelligence breach by Edward Snowden is an example of how an insider cyber threat can have great implications. According to a report on insider threats from Verizon, 57% of database breaches involved insider threats within an organization. And most of these incidents do not involve high profile individuals. Any employee with access to sensitive material can pose a risk to any business.

 

The same is true for cybersecurity in manufacturing. Manufacturing firms are susceptible to insider attacks just like any other organization. But the problem extends beyond the potential loss of data. Employees with access can actually sabotage an entire manufacturing technology operation. Note this incident that occurred at Elon Musk’s car company Tesla in 2018:

 

“Tesla CEO Elon Musk admitted this week that an employee managed to intentionally wreak havoc with the software code that underpins the company’s manufacturing system. The fallout has resulted in ‘quite extensive and damaging sabotage to our operations,’ according to Musk in a company-wide email that was leaked to CNBC two days ago.”

 

Of course, the best way to prevent this is to adequately screen employees prior to hiring them. And after they are on the job, it’s important to maintain an awareness of employee behavior and actions that might be suspect. Another key strategy is to follow the principle of least privilege, limiting system access to those who really need it to perform their jobs. 

 

Nation-State Actors

It goes without saying that every country does their best to gain intelligence that will help them defend their homelands. But some activities by nation-state actors may go far beyond that, constituting international theft or malicious attack. National governments have every reason to be careful and guard against suspicious activity by those from other countries.

 

Chinese telecommunications vendor Huawei has rolled out equipment extensively throughout Europe, but the U.S. government has limited their activity on American soil. The company has been banned from installing Huawei networking equipment since 2012. This has been an important issue for debate between the U.S. and its allies.

 

Manufacturers everywhere are aware of the risks to their operations and equipment posed by other countries. From the electric smart grid to the communications industry, it’s important to protect equipment and software from design to operations. 

 

Combating threats from foreign governments requires the same diligence that helps keep out any cyberattacker – strong firewalls, encryption, tight password policies, etc. But any company that has reason to believe they might become targets of international espionage should raise their defense levels in accordance with government guidelines. Most countries have established cyber security agencies that will help in the development of internal policies, and there are often government compliance issues to consider. 

 

Employee or Company Carelessness

Anyone can make a mistake, but when you’re dealing with critical data, mistakes can be costly. A database administrator may park some data on an unsecured server temporarily, but you never know who’s watching and when the bad guys may strike. Failure to adequately secure data, equipment, and software is inexcusable and should not be dealt with lightly.

 

Research by Norrie Johnston Recruitment (NJR) claims that the biggest cybersecurity threats to companies have to do with employee carelessness. From bad password management to insecure email handling, the worst security problem may be related to the failure to follow established security policies. When it comes to Industrial Internet of Things (IIoT) or Industrial Control Systems (ICS), maintaining secure access is essential. A 2019 report by CyberX found that 69% of passwords traversing the internet were in plain text — not encrypted. 

 

The answer for carelessness in industrial security is to broadly publicize and strictly enforce IT security policies. That means emphasizing the importance of security during staff meetings and  holding people accountable for preventable security incidents. It’s also critical that IT staff follow the strictest of guidelines maintaining data system security.

 

Commercial Espionage

According to the National Security Agency (NSA), cyber espionage is responsible for the loss of hundreds of billions of dollars per year. And according to Verizon, manufacturing is the #1 industry targeted by cyber espionage. An article from IIoT World tells us that the theft of trade secrets has been going on since long before the computer age. 

 

You can see how commercial espionage would be a major concern for manufacturing. There’s no question that companies are keen on protecting their trade secrets from competitors, and in the age of computing it requires significant IT security efforts. Recommendations from IIoT World include:

• Complete asset inventory
• Network segmentation
• Automated vulnerability assessments
• ICS threat intelligence
• Effective network monitoring

Blacksands’ Manufacturing Cybersecurity Solutions

The defense of Industrial IoT assets in the manufacturing sector starts with a clear policy, simple architecture, and a single technology that can provide granular knowledge and control of every dynamic connection. At Blacksands, we provide secure connectivity services for Manufacturing: Applications, PCs, IoT, and IT Infrastructure. Our service:

 

• 100% decrease in illegitimate connections
• 90% lower cost than alternatives
• Deploy in minutes instead of months
• Single easy to use solution to manage dynamic connectivity
• No Additional Employees needed to scale
• Know and Control every connection in Real-time
  • Who is connected
  • What is connected
  • Where the connection originates
  • When the connection occurs

 

Blacksands Secure Connection as a Service for manufacturing is simple, secure, scalable, and affordable. Contact us today for more information.