Elevating Cybersecurity Across the Manufacturing Ecosystem

Manufacturers of all sizes should recognize need for security mindset.

Large manufacturers across industry sectors recognize that security threats are proliferating rapidly across their domains. Corporations are reporting record profits – and cybercriminals always have operated on a “follow the money” basis, making them attractive targets for ransomware. At the end of October, for instance, Aurubis, the largest copper producer in Europe, had to shut down many of its IT systems after an apparent ransomware attack.

Most manufacturers also realize that cyber threats are not limited to IT systems anymore. For many years, industrial control systems (ICS) and operations technology (OT) were considered relatively safe because they were mostly closed-loop systems without internet access. This is changing quickly, however, as manufacturers look to modernize their facilities, using devices connected to the Internet of Things (IoT).

The Manufacturing Leadership Council (MLC), part of the National Association of Manufacturers, has identified cybersecurity as a key issue for members. The group recently hosted a webinar featuring Dragos experts specializing in industrial cybersecurity for OT environments. Dragos research has shown an increase in ransomware and other attacks in manufacturing, making the sector one of the top targets for cybercriminals. Attackers know that manufacturing plants cannot afford downtime, nor potential threats to the quality of their output.

The Nature of the Threat Environment

Ransomware is the most visible cyber threat to manufacturers. The initial impact to the Colonial Pipeline in 2021 was within its IT systems, but out of an abundance of caution the company had to shut down some of its pipelines to keep the attack from spreading to its OT environment. The ripple effect was significant – gasoline and jet fuel shortages spread up and down the East Coast, gas stations faced long lines of anxious and angry customers looking to fill their vehicles, and bottlenecks in airline traffic.

The attack had several longer-term effects. It set off alarm bells not just to Congress, but to numerous federal agencies responsible for the 16 critical infrastructure sectors identified by the U.S. Department of Homeland Security. In the wake of the attack, the White House continues to expand efforts to improve the security of industrial control systems with a multi-year, public-private partnership strategy.

High visibility cyber incidents like these tend to raise awareness across industries. A survey conducted by MLC found that nearly 62% of respondents said they have a formal OT cybersecurity plan; nearly 40% have “high confidence” in their internal expertise, while another 46% said they have “moderate” confidence. More than half have adopted the NIST framework for OT cybersecurity. But the survey also found that almost 50% of those surveyed said they had been targeted or had been a victim of a cyberattack.

Despite those numbers, less than half of respondents – 48% – said they have introduced or changed cyber requirements for third parties, such as vendors, with whom they share data.

“I would bet you that if you went back to your cyber team and said, ‘Do we protect our intellectual property in our OT devices on the plant floor,’ you might get an aha moment with them, and I think that’s a really important aha moment because this has happened,” said Dawn Cappelli, Dragos’ director of OT-CERT. “There was an actor who got into an OT environment, stole the intellectual property from OT devices, exfiltrated it and then sold it for millions of dollars … [Your cyber teams] know that your IP is protected in IT. You know where it is, and you have a lot of controls. But if they can get into your OT environment, it will be much easier for them to extract that intellectual property.”

Another risk, Cappelli said, involves building automation systems.

“There was an … external attacker who got into a company’s OT environment and then access[ed] the building automation systems,” she said. “They shut down HVAC systems, and suspended refrigeration. In this company, that had a big negative impact.” The lesson in that example is that every company’s risk is different, she explained.

The third example of a kind of OT threat is from an insider, whether they are a current or an ex-employee. Cappelli cited one instance where a former employee still had access to the company’s OT systems. “After he left, he repeatedly went into their OT environment and shut down pumps, he shut down alarms, he interrupted communications and did that over and over again.”

Companies may have routines in place to remove ex-employees from accessing IT systems, she warned, but they often don’t consider the same practices for OT systems.

Mitigating Risk – and the Role of OT-CERT

Cappelli highlighted five critical controls identified by the SANS Institute that Dragos recommends for protecting OT environments:

• An ICS incident response plan
• A defensible architecture
• OT visibility and monitoring
• Secure remote access, with multi-factor authentication
• A risk-based vulnerability management program

She discussed each of these points, but highlighted OT visibility for the manufacturers in the webinar. “You can’t protect what you can’t see,” Cappelli pointed out. “Your IT security technologies are not sufficient to protect OT. Some of them are a great partner to OT controls, but you need more specific solutions to address your OT environment.” There are tools available to provide that OT visibility, which she characterized as a “need to have.”

OT usually isn’t connected directly to IT, making vulnerability management a significant challenge. “As a [former] CSO, I can tell you this is the biggest challenge for CSOs with OT environments,” Cappelli said. “If you’re from the OT world, you know that we can’t just push out patches – it can bring down the plants [or] parts of the plants.” As a result, CSOs struggle with how to patch ICS/OT products.

“The good news is, only 4% of [published] vulnerabilities in ICS/OT required immediate action. They only require immediate action if they’re actively being exploited, or a public exploit has been put out there,” Cappelli said. “If you have a defensible architecture and you have OT network visibility and monitoring, you can just shelve the rest and do a risk analysis. But wait until the next scheduled downtime to worry about the priority vulnerabilities.”

While the largest manufacturers may have big, complex OT environments, they also have the internal and financial resources to protect their facilities. Cappelli said that it’s the small and medium-sized manufacturers who may be at greater risk of attack because they don’t have the same technical or financial depth. This is where Dragos OT-CERT comes in.

OT-CERT, Operations Technology – Cyber Emergency Readiness Team, is a program Dragos created to address the cyber resource gap affecting small and medium-sized manufacturing companies. “OT-CERT is totally free … We provide resources to OT asset owners and operators. It’s open globally, focused on these [smaller] companies because we realize they don’t always have a cybersecurity team,” Cappelli explained. “Everything we’re putting out there is something that their plant engineers can take and use, or they can hand to their IT people.” OT-CERT issues new content every month and has begun to hold regional workshops.