Safety and Cybersecurity in Industrial Automation

Security incidents involving household-name companies understandably attract news headlines, especially where individual customers may be directly affected by the breach. Attacks on industrial businesses, however, appear less likely to garner public awareness. But this doesn’t mean the risk to manufacturing isn’t real – or growing.

In one high-profile instance last year, a ransomware attack on one of the world’s largest aluminium companies resulted in tens of millions of dollars in damage. And that’s just one business. Attacks such as this are taking place at an increased pace – according to joint research by Forrester and Tenable, 94% of executives say their firms have experienced a business-impacting cyberattack or compromise within the past 12 months. The average cost of a data breach for a company is $3.86M.

It’s not just about the money, either. Factories and plants are packed with potentially dangerous machines. Surrender control of your equipment and processes, and the consequences could be interrupted production, yes – but also injury or worse.

We know that phishing attacks and malware pose some of the biggest threats to businesses. But in an industrial environment, there’s also a very real threat of physical danger. Ultimately, the most important part of safety in manufacturing is preventing accidents or risk to life, and industrial leaders must take every physical step necessary to prevent that.

When it comes to protecting people, cybersecurity is intrinsically linked to real-world safety.

Identifying hidden risks

It was once the case that in typical industrial settings, there was a clear demarcation between information technology (IT) and operational technology (OT) systems. These environments rarely touched and were usually managed by separate teams.

In modern manufacturing, the convergence of these two worlds has required an entirely new approach; not only for ensuring smooth operation, but in guarding against a new vector for cyber-attack.

For those seeking to disrupt manufacturing operations, the controllers involved in industrial processes are a desirable target. Think of some of the continuous processes in an industry such as oil & gas. They can’t be turned off with the simple flick of a switch. But hackers could gradually reduce pressure through valves or vessels to shut things down without anyone noticing. The notorious Stuxnet virus did something similar. By pushing nuclear centrifuges above safe speeds at an unnoticeably steady rate, nobody saw the failure coming. Not even the automation systems.

And it’s just one of several attacks that have been conducted in recent years. In fact, if a company has a data breach, it typically takes around six months to notice it. So, whether through covert attempts to hinder production or brazen demands for money through ransomware, cyber-attackers that take control of your processes also hold your employees’ safety in their hands.

While this is clearly a risk that manufacturing leaders need to be cognisant of, it doesn’t mean that you should seek to isolate all OT systems. As with any form of risk, the aim is to mitigate rather than remove altogether.

Finding a safe balance

With the right measures in place, there’s no reason you should forgo the benefits of connected industrial processes and risk falling far behind your competitors.

Having a connected environment is a valuable asset to your business and, with appropriate security measures in place, can be deployed both safely and productively. Imagine, for example, a motor for a pump system in a refinery in the middle of the desert. You could keep it offline and unconnected to reduce the risk of outside interference and rely on sending an engineer hundreds of miles every time you want to check the equipment. But without the instant information from a connected, algorithmic system, faults or problems could go undetected for longer. And cause breakdowns or worse – depending on the volatility of the materials involved in the industrial process.

In a situation such as the Stuxnet incident, mentioned earlier, air-gapping the systems from the Internet wouldn’t have prevented the damage caused. It spread through infected USB flash drives by targeting internal resources with access to the facility.

So, if it’s not going offline or isolating your systems…