Guide
A Comprehensive Guide to Manufacturing Cyber Security
Securing critical manufacturing sectors from today’s cyber risks & threats.
The manufacturing sector is one of the largest, most diverse, and rapidly changing segments of the global economy. And it is a top target for cyber adversaries. Robotics, automation, machinery, IoT/IIoT, smart devices — it’s time to secure manufacturing from threats, hackers, and risks.
New sections in the Comprehensive Guide to Manufacturing Cyber Security will be published over the next several weeks. Don’t forget to subscribe to get notifications!
Cybersecurity in Action
Learn how improved cybersecurity helped a paper mill manufacturer extend control system lifespan.
Table of Contents
Robotics
The first industrial robot was deployed in 1961. While the use of robots in manufacturing has continued to expand over the decades, the majority are still used in automotive plants, where they represent more than half the “labor” needed to build automobiles and trucks. Robotics has advanced to the point that 100% automated “lights-out” factories have been operational for several decades in sectors such as computer manufacturing.
Wearables
Wearable computing and sensor devices are finding numerous applications in manufacturing environments. Devices fall into several categories, many of which are focused on employee safety, such as fall prevention, sleep prevention, noise reduction, or improved respiration. Many wearables are also focused on enabling better communication, potentially including access control — between employees and between machinery — as well as on providing easier access to information through a host of delivery mechanisms.
Internet of Things/ Industrial Internet of Things
The Internet of Things (IoT)/ Industrial Internet of Things (IIoT) references a broad set of physical devices that combine embedded sensors, processing power, software, and often analytic capabilities to communicate real-time information about aspects of the physical world, such as temperature, pressure, motion, etc. Consumer applications can include smart home devices, among many others. A subcategory of more hardened devices generally termed the Industrial Internet of Things (IIoT) has also developed and found its way into manufacturing plants. IIoT devices can include an actuation component and, therefore, can function as industrial control system (ICS) devices. The manufacturing applications of IIoT are almost limitless.
3-D Printing
Additive, or 3-D, printing enables the creation of three-dimensional objects directly from a CAD drawing by building up an object one layer of material at a time. 3-D printing is particularly useful in the prototyping phase of product development. Still, the size, speed, and quality of 3-D printing have improved to the degree that the technique is used in space, aerospace, wind turbine, and many other critical manufacturing sectors.
Virtual Reality/Augmented Reality
Virtual reality (VR) describes a self-contained, computer-simulated environment and is another technology with broad application in product development applications for manufacturers. It is also an important tool for worker training. Augmented reality (AR) is a less immersive experience and involves superimposing digital information into the real world. This information can be as simple as a heads-up display of written material, for example, repair manuals, or it can be much more immersive and include other senses such as hearing and touch.
Machine Learning/Artificial Intelligence
Machine learning (ML) is a subset of artificial intelligence (AI). ML is a technique where computer algorithms can be trained to “improve” through experience. AI and ML can improve manufacturing techniques in a host of ways and are being applied to generate general process improvements, accelerate product development, and improve quality control. Manufacturers today are using AI/ML to improve manufacturing yields, optimize asset management, manage supply chain and inventory, improve predictive maintenance and demand forecasting, among many other applications.
Cybersecurity in Action
Learn how improved cybersecurity helped a paper mill manufacturer extend control system lifespan.
Read the Case Study
Figure: Factory Floor Overview – Smart Technologies at Work
Main Operational Technology (OT) Threat Actors
Attacks Against Manufacturers
According to a report by the cyber insurance company Allianz, cyberattacks against critical infrastructure are more likely to target ICS than attempt to steal data. A survey of critical infrastructure suppliers showed that 54% reported attempts to control systems, and 40% had experienced attempts to shut down systems. While manufacturers are particularly vulnerable to attacks designed to cause extended operational downtime, they are also highly sensitive to the loss of trade secrets and customer data. This is true across the board but particularly for manufacturers working in the Defense Industrial Base (DIB) sector.
Disruptive Cyberattack Example at Honda Manufacturing Plant
Unfortunately, business changes made in response to the COVID-19 virus have likely contributed to the increase in attacks during 2020. Remote workers are particularly vulnerable to phishing attacks, which can become a vector for ransomware attacks. Ransomware typically locks down data until a ransom is paid, but for a manufacturer, that is the equivalent of locking down the production line. Manufacturers have been particularly hard hit by ransomware, seeing the steepest increase of any industry in the first quarter of 2020, according to a June 2020 report from cyber insurer Beazley.
Manufacturers suffer from having to maintain highly dispersed and heterogeneous infrastructure and supply chains. Embracing Industry 4.0 technologies makes it even more difficult for organizations to create and maintain accurate real-time inventories of their OT/IoT devices and systems. But this is a minimum requirement for developing a baseline cybersecurity strategy for OT and IT systems: manufacturers must be able to monitor their network state in real-time and understand device behavior. The ability to detect anomalous activity in near real-time is key to preventing operational disruptions, whether from maintenance issues or cyberattacks.
Another difficulty is that basic threat intelligence information is often lacking on attacks targeting OT and IIoT infrastructure. Cybersecurity teams need to be able to detect, analyze, and react to indicators of compromise (IOCs) and anomalous behavior in their network. The broad deployment of IIoT devices provides numerous beachheads for attackers who can then quickly move laterally through a network. Network segmentation is, therefore, a critical component of OT cybersecurity strategies.
The 2019 Deloitte and MAPI Smart Factory Study conducted by Deloitte and the Manufacturer’s Alliance for Productivity and Innovation (MAPI) found that over 12 months, 40% of the manufacturers surveyed had operations affected by a cyber incident. Of those affected, 87% suffered unauthorized access to infrastructure; 86% experienced operational disruptions; and 85% experienced intellectual property theft.
Figure: Stats from the 2019 Deloitte and MAPI Smart Factory Study
Recent Successful Attacks
Unsurprisingly, there have been a host of successful attacks against even the largest manufacturing companies over the last several years. Mondelez was hit by the encrypting malware NotPetya in 2017. Renault-Nissan stopped production in five plants in 2017 when the WannaCry ransomware struck. LockerGoga ransomware was also deployed successfully against aluminum manufacturer Norsk Hydro in 2020. The company was forced to temporarily close many of its plants. In 2019, space and defense manufacturer Visser Precision was hit with the DoppelPaymer ransomware.
Significant Cyber incidents against Manufacturers in Recent Years
Manufacturing Cybersecurity Maturity Model
A particularly vexing problem for manufacturers is the global nature of their supply chains. This has led to several efforts to create more secure supply chains, most notably perhaps the DHS’s Cybersecurity Maturity Model Certification (CMMC) program for the DoD supply chain.
In 2020, Carnegie Mellon University and the Johns Hopkins University Applied Physics Laboratory LLC released CMMC version 1.0 as part of work funded by the DoD. The CMMC is designed to help improve the security posture of the 300,000 companies that make up the DIB sector and the supply chain of the DoD.
The initial mandate of the CMMC is relatively modest: to protect unclassified (but sensitive) data across the DIB ecosystem. This includes federal contract information and controlled unclassified information. Although manufacturers represent only a subset of the companies covered by CMMC, and DIB manufacturers likewise are only a subset of the critical manufacturing sector, the CMMC is worth understanding both as an example of best practice and because it is likely to become a blueprint for broader regulation, at least in the U.S. For best practice in protecting OT manufacturing infrastructure, we will turn shortly to the NIST Cybersecurity Framework Manufacturing Profile, which also provides a coarse-grained maturity model.
As the CMMC document notes, “a maturity model is a set of characteristics, attributes, indicators, or patterns that represent capability and progression in a particular discipline. The content of such a model typically exemplifies best practices and may incorporate standards or other codes of practice to that discipline.”
The CMMC model framework organizes cybersecurity processes and practices into domains that are mapped across five maturity levels.
- Level 1 corresponds to Basic Cyber Hygiene practices that typically involve ad-hoc implementation with limited or no documentation.
- Level 2 corresponds to Intermediate Cyber Hygiene practices and is viewed as a transitional stage with a focus on a prioritized subset of security requirements.
- Organizations at Level 3 are considered as practicing Good Cyber Hygiene, meeting all the security requirements of the benchmark NIST SP 800-171 standard.
- Level 4 practices indicate a more Proactive posture with security practices reviewed and measured for effectiveness and with corrective action taken as necessary.
- And finally, the Advanced/Progressive practices of Level 5 require organizations to optimize their security process implementation across their assets and include a focus on protecting against advanced persistent threats (APTs).
(See the Cybersecurity Maturity Model Certification Version 1.0 Appendices published on January 30, 2020 for more detail on policy construction recommendations at each maturity level.)
The biggest value of a maturity model is its focus on cybersecurity as a process that needs to be structured, prioritized, and well documented. This should be the orientation regardless of whether the focus is on cybersecurity for IT or for OT.
Figure: CMMC Maturity Process Progression
The NIST Cybersecurity Framework Manufacturing Profile
The NIST Cybersecurity Framework Manufacturing Profile provides a useful framework for protecting both IT and OT infrastructure. As the document notes, the “reliance on technology, communication, and interconnectivity of ICS [industrial control systems] and IT has changed and expanded the potential vulnerabilities and increased potential risk to manufacturing system operations.”
NIST takes a broad view of manufacturers, addressing the needs of process-based manufacturers—both continuous and batch, as well as the needs of discrete-based manufacturers. The Manufacturing Profile builds on the five concurrent and continuous functions at the core of the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover.
Figure: NIST Cybersecurity Framework - Identify, Protect, Detect, Respond, and Recover
The Manufacturing Profile is designed to support cybersecurity outcomes based on the business needs of each manufacturer, which are determined from selected framework categories and subcategories. The detailed subcategories are derived from the security controls of NIST Special Publication 800-53 (NIST SP 800-53). The Profile provides tailored values for cybersecurity controls for manufacturing infrastructure. Categories and subcategories are created “based on domain-specific relevance, business drivers, risk assessment, and the manufacturer’s priorities.”
Objectives and Functions
The manufacturing business objectives of maintaining human safety, environmental safety, quality of product, production goals, and trade secrets are aligned across functions, categories, and subcategories of cybersecurity objectives. In addition to these, security levels of Low, medium, and High are used to prioritize implementation of the framework. Severity levels can be used to inform a maturity model but should not be confused as a substitute for a maturity model. The former is tactical, and the latter is strategy. The Profile should therefore not be viewed as a maturity model so much as a road map that is progressively more useful to organizations with higher levels of cybersecurity maturity.
For example, the “Asset Management” category and its “Asset Identification” subcategory fall under the framework’s “Identify” function. NIST classifies the automated detection of unauthorized hardware and firmware as a “high” impact task. Clearly, however, the task’s value is higher if it is part of a continuous process of well-documented asset discovery and management than if it is a one-off scan of OT assets.
One of the most important benefits of moving up the maturity curve is the ability to integrate with broader enterprise risk management solutions. There is currently a significant gap between the output of most cybersecurity risk management programs and the input that is required to effectively integrate cybersecurity into traditional enterprise risk management systems. NIST is attempting to address this issue, and in 2020 it released NISTIR 8286: “Integrating Cybersecurity and Enterprise Risk Management (ERM),” which provides a good overview of the issues and some potential solutions.