Operational Technology Cybersecurity in Manufacturing: Exploring the Invisible Risks

By Nick Creath, senior product manager at Rockwell Automation

Threat actors’ potential to disrupt critical industries, such as food, energy, and water, has given rise to a new breed of cybercriminals, who have now set their sights on exploiting vulnerabilities within Operational Technology (OT) and industrial control systems (ICS) in the manufacturing sector. As manufacturers enthusiastically embrace automation and cloud-based technologies to bridge the gap between IT and OT networks, they must face the daunting challenge of addressing the concealed, yet serious, cybersecurity risks accompanying this convergence.

The Escalating Confluence of IT and OT Networks

The prevalence of smart manufacturing technology, seamlessly integrating IT and OT networks, continues to soar. Recent studies show that an overwhelming 84% of manufacturers have either already embraced or are actively considering the implementation of smart manufacturing solutions. These transformative innovations encompass a wide array of solutions, ranging from smart devices and asset performance management to production monitoring and distributed control systems. The widespread adoption of these solutions empowers manufacturers to streamline processes, optimize production, and conquer workforce challenges more adeptly.

Amidst this rapid technological advancement, investing in digital cloud technologies that effectively connect IT and OT networks has emerged as a pivotal enabler of process automation. By facilitating seamless information exchange between systems and assets, these technologies adeptly automate various aspects of production. Realizing the full potential of process automation and unlocking the benefits of optimized production mandates that manufacturers prioritize the digitalization of essential manufacturing solutions, including manufacturing execution systems (MES), quality management systems (QMS), and other core business systems. Nevertheless, the security risks associated with deploying these solutions and connecting IT and OT networks pose significant concerns.

Unveiling Oversights: Common Causes and Encountered Hurdles

As manufacturers grapple with intrinsic challenges like quality and growth management, compounded by extrinsic adversities like inflation and supply chain disruptions, the potential cybersecurity risks stemming from digital transformation can remain obscured. Astonishingly, despite their importance, cybersecurity risks rank as the sixth most prominent concern faced by manufacturing businesses today.

In the face of such unsettling statistics, it is paramount for manufacturers to recognize that the global impact of supply chain cyberattacks is projected to affect approximately 45% of organizations by 2025. It is therefore imperative for manufacturers to acknowledge that cybersecurity risks like material shortages and workforce challenges, cannot be ignored.

Unseen Perils of IT and OT Convergence

Historically, cyberattacks targeted IT systems due to their extensive external connectivity. However, the proliferation of smart manufacturing technologies has introduced increased connections between OT and IT networks. While these interconnections facilitate real-time information exchange and updates, they also expose vulnerabilities.

A wide spectrum of tools and technologies are used in these connections, ranging from wireless links between IT and OT systems to human-machine interfaces (HMI), programmable logic controllers (PLC) responsible for controlling shop floor machines, supervisory control and data acquisition (SCADA) systems enabling real-time OT data capture for industrial process automation, and engineering workstation applications.

Despite IT systems effectively safeguarding valuable data concerning production processes and customer information, their inability to exert direct control over production activities renders OT systems susceptible to manipulation. The compromise of OT networks by cybercriminals may trigger complete manufacturing facility shutdowns, resulting in severe disruptions throughout the supply chain. Faced with such perils, manufacturers must recognize these risks and place OT cybersecurity measures at the forefront of their strategic priorities.

Fortifying OT Network Cybersecurity

Addressing vulnerabilities and enhancing infrastructure security proactively stands paramount in reducing organizational and operational risks. In this endeavor, manufacturers must embrace the recommendations delineated in the National Institute of Standards of Technology (NIST) Cybersecurity Framework:

• Identify: Embarking on a comprehensive inventory of network assets, including industrial control systems and novel software/devices, and conducting Zero Trust assessments, prioritizing critical Data, Assets, Applications, and Services (DAAS). 
• Protect: Implementing appropriate safeguards aligned with compliance standards and security frameworks, such as multi-factor authentication, access control, data security, and network segmentation. 
• Detect: Vigilantly monitoring all endpoints within the network, complemented by leveraging threat detection services for real-time visibility and deep network inspection. 
• Respond: Establishing a mature incident response plan, periodically testing and refining it, and fostering collaboration with seasoned OT security professionals for optimal risk management.
• Recover: Prioritizing swift production operation restoration via backup and recovery services and conducting exhaustive incident analyses to identify root causes and address security gaps.

Embarking on a Secure Journey with Comprehensive OT Cybersecurity Plans

Crafting a robust OT cybersecurity plan mandates that manufacturers understand the specific risks and vulnerabilities unique to their operations while embracing a holistic approach encompassing people, processes, and technology. In this pursuit, collaboration with experienced OT cybersecurity professionals assumes paramount significance in maintaining the plan’s efficacy and enduring sustainability. By wholeheartedly acknowledging and diligently addressing the risks accompanying IT and OT convergence, manufacturers can confidently shield their production processes, safeguard their supply chains, and effectively harness the transformative potential of automation and digital technology solutions.