Elements of a Robust Risk Management Approach

Given the ongoing – and often high-profile – stream of news coverage, it’s hardly surprising that cybersecurity has become an important issue for manufacturing leaders. While the risks to industrial environments are not new, there’s a reason why security has become such a focal topic. Manufacturing operations typically advance slowly, yet cyber attackers move with great speed, adopting new tactics and techniques while always capitalising on ways of scaling their activities.

While ‘faster’, more digitally centred sectors, such as IT, e-commerce and fintech, have been nimbler in protecting their systems and networks against risks, many manufacturers are still playing catch up. Like the slowest gazelle in the herd, leaders in the sector realise they must move faster if they are to outpace potential predators.

For industrial leaders, it’s vitally important to be cognisant of how strongly their organisation’s security approach compares with their peers and take action to reduce the risk of falling prey.

Taking a Holistic Approach

Leaders need to take a wide-lens approach to their cyber defence. Any organisation is only as secure as its weakest link and it only takes one vulnerability to leave the network open to a broad range of potential attacks. Threats emerge from a variety of sources, ranging from simple employee errors to an unsecured network, meaning that no area can be ignored.

The complexity of current industrial environments means that dependencies and impacts can be difficult to spot. There has been a great deal of progress in employee awareness around best practices regarding password protection, device security and the secure use of cloud-based platforms. However, threats can emerge from areas beyond your organisation’s control. If, for example, a supplier suffers a data breach, how could this impact your organisation? This pushes the need for your entire organisation – and its wider network – to raise its cybersecurity threshold and to spot any weak points before they become an issue.

Key Elements of Robust Cyber Risk Management

While no environment can ever be fully secure, there are fundamental steps that will help to embed cybersecurity, not just from an operational perspective, but also from the point of view of building a security-minded company culture. These elements can help to build up the level of robustness needed for ongoing progress.

• Sponsorship

Executive leadership needs to set the tone and expectations around cybersecurity. If it’s not seen as a priority issue at board level, it will never be given adequate consideration and emphasis at the management and employee levels. Resourcing and funding are a key part of this, including the possibility of having a cyber expert in the boardroom to help shape and direct the strategy.

• Accountability

Everyone in the organisation needs to see cyber defence as part of their job. With a more pervasive use of digital devices and software services in everyday work, the span of potential threat vectors has become vast, and often opaque to those managing the network. For example, if an employee is using a device for both professional and personal purposes, are they taking the same precautions for all online activity? Does anyone else have access to the devices? Awareness and training play an important role in devolving these responsibilities across the network and helping workers to understand their role in the process, adopt best practices into their daily work and to avoid the risk of errors.

• Collaboration

Cybersecurity is a company-wide endeavour. No one department or team “owns” cybersecurity, and the responsibilities are too great for IT to be left with the heavy lifting. Siloing the response only hinders the organisation’s speed in acting on emerging threats. In industrial environments, we’re seeing the gap between IT and OT continually diminish as ‘integration’ becomes a core business objective. As the different parts of the organisation integrate at a process and workflow level, there must also be integration at a security level.