Address the threats

There is an increasing number of manufacturing companies choosing to go digital in an effort to not only improve their operational efficiency, but to also offer new products and services to their customers. However, whilst the shift to digital has been the right choice for many manufacturers, it has also opened the door to a whole new host of security issues. Many security threats such as ransomware attacks have been on the rise in many different sectors, however it’s the manufacturing industry that has experienced the biggest spike in cases with a 156 percent increase quarter on quarter since 2019. This of course will likely raise concerns for manufacturers who are targeting greater market shares.

It also does not help that given the strong appetite for digital manufacturing solutions, solutions providers are accelerating the release of these applications to achieve better time to market and gain greater market share. However, this comes at the risk of leaving their digital solutions wide open to a variety of cybersecurity threats. Manufacturers and solutions providers need to consider the available solutions to ensure greater levels of security for these systems. A big part of the answer to this lies with security standards and policies.

Industrial Control Systems and rising cyberattacks
Manufacturers rely on digital tools such as control systems for production management, processes automation, and reporting. Industrial Control Systems or ICS are used at manufacturing plants to help monitor complex manufacturing processes that support critical infrastructure, such as power and transportation for instance. It is easy to see why manufacturers are looking to benefit from this convergence between operational and information technology.

Any security vulnerabilities with these digital tools could compromise the integrity and availability of data, and as a result have a serious impact on their business. What’s more, any downtime in factory operations can result in a loss of productivity, and by extension revenue. The advancement of technology and the increased digital connectivity has a large part to play in broadening the attack vector for cyberthreats. This is because an increasing number of ICSs are being connected to the Internet of Things (IoT) and the cloud where a considerable amount of data exchange is taking place.

The more sophisticated cybercriminals are also looking to take advantage of the new opportunities that IoT brings as sensitive data is being shared through IoT at a much higher volume. As a result, the risks of data being compromised is exponentially higher in ICS’ that leverage the power of IoT technology.

As such, creators of these digital tools need to take an approach that is both fast and safe when it comes to developing these solutions that manufacturing companies rely on. In addition to this, they also need to carefully examine the security implications of these tools via a multi-pronged approach to cybersecurity that includes adhering to set security standards and policies.

Greater security protection: standards and policies
In addition to having a robust cybersecurity infrastructure, manufacturers also need to adhere to certain security standards and policies specific to the safe and secure use of Industrial Control Systems.

One of the said security standards is the ISA/IEC 62443, which is a series of standards designed to regulate and ensure the security of ICS by identifying and mitigating security vulnerabilities. The standards are combined with existing enterprise security to ensure adherence to the necessary requirements needed for business IT systems along with unique regulatory security requirements. The ISA 62443 series clearly defines the complete security requirements needed throughout the software development lifecycle for ICS solutions, ensuring that product security is considered at every stage in the application development.

Another security standard framework for ICS is the NIST SP 800-82, which provides guidance for manufacturers on how to best secure their digital control systems whilst also addressing specific reliability, safety and security requirements. This security standard can be used to identify and outline typical threat vulnerabilities as well as recommending the most effective security safeguards and countermeasures required to neutralize threats.

In addition to security standards, manufacturers also need to consider policies and procedures related to the software development lifecycle that go beyond the development and deployment of systems and applications. The need for a security policy is paramount as it enables you to define the roles, implementation, and enforcement of the system’s security program. A lack of security policy can often introduce security vulnerabilities in ICS’. Both the ISA/IEC 62443 and NIST SP 800–82 cover the topic of policies and procedures in-depth.

Security standards are vital for the development of highly efficient manufacturing ICS’ and the type of standard framework to adopt will mainly depend on the industry itself and its requirements. Digital manufacturing solutions require robust security protection, especially as system connectivity is a key feature in many solutions, which will continue to be susceptible to new threats.

Since connected systems are always prone to new threats, a multi-faceted approach is required to address the varying threats. Following a security framework can help guide organizations into such a holistic approach. Regardless of which security standard is being used, each framework provides a wealth of information about protecting industrial control systems.

For sources used in this piece, contact the editor.

Altaz Valani
Altaz Valani is Research Director at Security Compass (SC), a leading provider of cybersecurity solutions. SC enables organizations to shift left and build secure applications by design, integrated directly with existing DevSecOps tools and workflows. Its flagship product, SD Elements, allows organizations to balance the need to accelerate software time-to-market while managing risk by automating significant portions of proactive manual processes for security and compliance. SC is the trusted solution provider to leading financial and technology organizations, the US Department of Defence, government agencies, and renowned global brands across multiple industries.
www.securitycompass.com