IT in Manufacturing


Not enough is being done around industrial cybersecurity

August 2017 IT in Manufacturing

From energy plants to airports, and mines to the manufacturing shop floor, companies are realising that the IIoT, (Industrial Internet of Things) presents an enormous potential for better efficiencies and sustained growth. Operational Technology (OT) and Information Technology (IT) networks are becoming more interconnected to take advantage of this potential, and although this could transform OT (scada, DCS, ICS) procedures and methods, it also brings with it new risks to the OT environment – risks for which the industry is not yet equipped to handle, cyber risks.

Tommy Thompson.
Tommy Thompson.

OT cyber attacks are not just theory, they are happening

Just in the last few months, we have seen two outbreaks of ransomware that brought a stop to production at a few of the world’s leading automotive manufacturers. To add to this, there have been several other well-publicised attacks against OT systems, and these attacks are only going to increase. These incidents are not just specific to one sector, as all industries in the OT space could be affected.

Critical infrastructure attacks are not just targeted at power companies, as was the case with a Ukraine power company that was attacked twice in a period of twelve months, resulting in over 80 000 households being affected. These attacks are also targeting water utility companies. In the past few years, there have been three major attacks against water utilities – in the first attack, a cyber criminal managed to compromise the OT environment and spill 800 000 litres of raw sewage into surrounding areas, including a 4-star hotel. In a second attack, an unknown group of cyber criminals compromised a utility’s OT systems and changed the chemical balance for drinking water. The affected water had to be pumped out to sea. In the most recent attack, a water department’s smart meter central management unit was hacked and used to reprogram all the smart meters.

There have also been cyber attacks against manufacturing companies. In one case against a glue manufacturing company in northern America, hackers managed to get into the OT system and then hold the company to ransom. In a more recent attack, a pharmaceutical company was compromised and the hackers aimed not only to steal the IP, but also at disrupting the manufacturing processes.

The risks and where to start

We need to acknowledge that these risks exist and pose a real threat to the industry. OT systems were not designed with security in mind; they were designed and built with availability, integrity, and uptime as the principal requirements. We need to create the awareness and understanding that these systems, that were in some cases previously separate (air-gapped), now need to be protected. Industrial espionage, cyber criminal gangs, extortion and ransom – these are just some of the threats that form part of the new threat landscape to OT systems. Attacks and disruptions on OT systems put reputation, production, people, and profits at risk.

Inserting a firewall between the corporate IT network and the OT environment is no longer enough. It’s a start, but the companies running these types of new generation OT systems need to build a more resilient infrastructure.

The cybersecurity process should start with the collaboration between the OT and IT teams. The IT team understands cybersecurity and the OT team understands ICS and scada and their unique requirements. A second step would be to perform a passive risk assessment along with segmenting your OT environment. During the assessment process, all OT assets will be identified, classified and then lastly, assigned a level of risk. The above process will also assist with the grouping of similar assets, which will allow for successful segmentation to help protect the various OT layers, along with adding a layered defence to the OT environment. There also needs to be the formulation of a functional cybersecurity policy, as this will help to outline where the company needs to go, and more importantly, what is needed to achieve the parameters set out in the cybersecurity policy.

To end it off, staff need to participate in cybersecurity awareness training. An educated employee can make better decisions when faced with a potential fraudulent email or someone who has contacted them, stating they are from IT and need to reset a password. An educated employee will also think twice about inserting a USB drive, perhaps found outside the parking lot, into the corporate network.

For more information contact Tommy Thompson, Nclose, +27 (0)11 463 0096, tommy@nclose.com, www.nclose.com





Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Bringing brownfield plants back to life
Schneider Electric South Africa IT in Manufacturing
Today’s brownfield plants are typically characterised by outdated equipment and processes, and face challenges ranging from inefficient operations to safety hazards. However, all is not lost, as these plants stand to gain a lot from digitalisation and automation.

Read more...
Faster access to device data
EPLAN Software IT in Manufacturing
Eplan eStock gives companies access to centralised device management in the Eplan Cloud, simplifying collaboration, and reducing coordination times and media discontinuities.

Read more...
Accurate and effective bearing replacement
SKF South Africa IT in Manufacturing
Each year, incorrect mounting is causing countless bearing failures. Overcoming this can deliver multiple benefits to owners and operators of rotating machinery, including reduced maintenance costs and fewer breakdowns.

Read more...
Comprehensive protection of the network
Phoenix Contact IT in Manufacturing
In recent years, the generation of data to create ever better transparency and control of production has become a decisive competitive factor. IIoT has also contributed to more manufacturing systems being connected to IT or cloud systems. This places higher demands on access security, which Phoenix Contact meets with the Secure Edge Box.

Read more...
Manufacturers should watch for these five trends
IT in Manufacturing
Over the last several years trends have emerged in manufacturing, realising significant advancements in machine-reliant assembly lines through to highly automated factories. As we look ahead, there are several key trends to watch.

Read more...
The role of technology in mining safety and environmental protection
IT in Manufacturing
Modern mining practices routinely integrate technology into workflows to improve operational efficiencies. AI can also play a role in managing employee health, decreasing safety risks, and managing the environmental footprint of mining and extractive industries.

Read more...
Design lubrication-free applications in seconds
igus IT in Manufacturing
igus has unveiled its point-and-shoot igusGO app, a cutting-edge solution that uses a mobile phone to photograph moving parts on equipment and immediately get information on a lubrication-free alternative.

Read more...
A guide to tackling your company’s e-waste challenges
IT in Manufacturing
In our digital age electronic devices are pervasive, and businesses cannot function without them. This has created a growing problem. When these devices reach the end of their lifespan, they need to be disposed of correctly, and not simply dumped into an ever-growing electronics graveyard.

Read more...
Machine safety, diagnostics and data security
Turck Banner Southern Africa IT in Manufacturing
Personnel safety systems on machines are often seen as a necessary evil. To function correctly, a safety device is required to be self-checking, which adds more complexity and costs compared to a non-safety device.

Read more...
SMOM – the future is here now
Iritron Editor's Choice IT in Manufacturing
In his presentation at the recent MESA Africa conference, Neels van der Walt, business development manager at Iritron, revealed the all-encompassing concept of smart mining operations management (SMOM), and why it is inextricably linked to the future of worldwide mining operations.

Read more...