By Elliot Forsyth, Vice President of Business Operations at the Michigan Manufacturing Technology Center (The Center)
Manufacturers are increasingly under threat from cyberattacks. This is a real concern not just because of the typical business vulnerabilities (e.g., stolen intellectual property, ransomware) but because in today’s increasingly connected world, a successful infiltration from a cybercriminal could shut down a plant’s operations or start making equipment produce faulty products without the knowledge of managers, among other things.
Additionally, most manufacturers are small businesses that do not have established IT security practices to combat or cope with a cyber-incident. This lack of preparedness not only makes it easier for cybercriminals to attack, it also increases the likelihood that impacted companies will experience longer periods of downtime as they scramble to restore operations following a cybersecurity issue.
While some manufacturers may still be a ways off from creating a mature cybersecurity practice, every manufacturer should be aware of the five main cybersecurity threats to their company. Familiarizing yourself and your employees with them is the first step in reducing the risks they pose.
1. Identity Theft
People are most familiar with the identity theft that happens when hackers get their Social Security Numbers and use them to apply for loans or lines of credit. When it comes to the manufacturing sector, problems arise if hackers break into a customer database with help from malware and access customer data, which can potentially be used to practice identity theft.
A recent such incident happened to a Tennessee-based company called Titan Manufacturing and Distributing. Hackers had access to the customer database for nearly a year, giving them plenty of time to grab sensitive information.
2. Phishing
Phishing occurs when cybercriminals craft convincing emails and use them to trick recipients into revealing sensitive information such as passwords. These messages often have branded letterheads or similar elements to help persuade people of their legitimacy. Phishing emails generally target a wide audience and are fairly easy to spot with generic greetings such as “Dear valued customer.”
3. Spear Phishing
Spear phishing is a highly targeted kind of phishing that may only address one person at a manufacturing company or people within a particular department. In contrast to the phishing attempts previously mentioned, these targeted messages are more specialized and relevant to the recipient. For example, a person working in the accounting department might receive a spear phishing email about a particular invoice or tax form.
Some spear phishing attempts appear to come from a company leader and may request that the recipient give details about logging into a company’s industrial control systems (ICS). If a business invests in identity and access management (IAM) solutions, they could cut down on the success rates of spear phishing emails. If a spear phishing email recipient receives a request from someone posing as the CEO of a company that has IAM in place, for example, that individual would likely realize something is amiss because the real CEO should know about the access restrictions that the phishing email would violate.
4. Spam
Spam messages are annoying for everyday people, but they can substantially reduce productivity at manufacturing plants. At one Dunlop Industrial plant in South Africa, members of the IT team had to manually sort through approximately 12,000 spam messages a day — a task that required up to 90 minutes and kept them from more effective uses of their time.
In that case, the company deployed a mail service solution that scanned messages for spam characteristics and malware before users saw them, removing the messages before they hit employee inboxes. But there will always be an element of human judgment since it’s not always easy to tell a spam message from one originating from a genuine customer or supplier, which makes spam a persistently challenging issue.
5. Compromised Webpages
Webpage compromises happen when hackers take control of websites and either make them inoperable or fill them with misleading content to fool customers. Sometimes, hackers embed programs that automatically install dangerous files on site visitors’ computers without their knowledge. These situations can severely damage the reputations of the impacted manufacturing companies.
Protecting Yourself from These Threats
The best way to fight back against these five threats and others is to implement a formal cybersecurity practice at your company. The NIST 800-171 Cybersecurity Framework provides an excellent starting point, taking a simple, five-pronged approach to tackle threats. Each step is accessible and affordable, making it feasible for small manufacturers.
Additionally, if companies encounter unforeseen difficulties or have questions about the framework’s documents, help is available via the Manufacturing Extension Partnership (MEP) Center in their state. Through the MEP National Network, each MEP Center can provide manufacturers in their territory access to experts versed in the NIST 800-171 Cybersecurity Framework who can help design an appropriate cybersecurity practice and implement it. You can also complete the NIST MEP Cybersecurity Self Assessment, which allows manufacturers to self-evaluate the level of cyber risk to their business.
Insulate your company against the growing cyber threats affecting the manufacturing sector. Connect with your local MEP Center today and develop a plan and practice to protect your firm and its future.
For information on how you can help protect your company from Cyber Threats in Kentucky, please contact Kurt Felten, Marketing Specialist for Advantage Kentucky Alliance at 270-745- 3370 or [email protected], or visit our website at www.advantageky.org.
