The manufacturing industry is becoming more dependent on technology and the internet. While these advancements have made processes easier and faster, they also pose serious security risks. In today’s digital age, cyber threats are increasing and becoming more complex, and manufacturers must take proactive steps to protect their systems and data.
Here are four essential steps to harden your manufacturing industry cybersecurity:
Manufacturing Industry Cybersecurity Hardening in 4 Simple Steps
The manufacturing industry faces significant cybersecurity threats that require proactive measures to ensure the protection of data and systems. To harden manufacturing industry cybersecurity, it is crucial to implement four simple steps.
- Train your end-users: End users are the single most vulnerable part of cyber security. Users who are not careless or unaware of cybercrime are the number one reason companies are attacked by hackers.
- Harden your network: To harden your cyber security you need to make sure your network is properly maintained. Patch your systems weekly. Know what systems are not patching and fix it. Remove or isolate vulnerable systems. Replace old software with known vulnerabilities.
- Have bulletproof disaster recovery: All too often we are contacted by companies that were hit by cybercrime and had zero backups they could restore. Monitor and never stop watching your backups.
- Have Cyber Insurance: Insurance companies are changing their policies given the large payouts they are being forced to make. Be aware of this and ensure you have great insurance.
Here’s a real-world example of how important this is:
Network Recovery in Guelph, ON | One of our first experiences with successful ransomware was an occasional customer that had unmanaged internal IT staff. This was their 3rd IT professional in 4 years, and had not checked any existing backups for over 8 months. Facing over half a year of data loss, the company was forced to pay the ransom. It still required almost 2 weeks of intense work to restore the network to a working state. The attack cost them an amount equal to their IT Staff salary in just a few days.
Provide Cybersecurity Training to Staff
Ensuring robust manufacturing industry cybersecurity is crucial. Cyber threats are not just limited to IT staff but can affect every employee using a computer or other digital devices. Research shows that most cyber attacks are caused by human error, such as clicking on malicious links or opening email attachments from unknown sources or using weak passwords. Hence, it is essential that every employee in the manufacturing industry receives proper cybersecurity training to identify and avoid such common mistakes.
According to the Canadian Internet Registration Authority’s 2020 Cybersecurity Report, 30% of businesses experienced increased cyber attacks during the pandemic.
Why is this happening? As users moved to their home offices to work, many businesses shifted to remote work incredibly quickly. This resulted in some key defences against cybercrime being weakened compared to working from a central office. Companies were left more vulnerable to cyberattacks by well-meaning employees who were aggressively targeted with Phishing attacks. Bad actors took advantage of this and increased their efforts significantly.
One of the best ways to protect your business and harden your cyber security is to ensure your staff are well trained.
What is the right training for manufacturing industry cybersecurity?
We have offered free cyber security training webinars for manufacturing businesses in the past. Today we rely on a combination of web-based training programs that are relatively automated and personal training for customers.
Teach the basics of cybersecurity
An employee should be educated on the different forms of cyber threats. We want the customer’s staff to “think before they click.” Being made aware of this helps employees because it keeps the concept of cybercrime fresh in their minds. Stopping this single action (clicking when you should not) is the single biggest thing you can do to protect yourself.
Some of the most common cyberattacks are:
- Malware: Any malicious form of software that is intended to harm a user’s computer.
- Phishing: Usually an email (but easily a Tweet or Facebook post) designed to trick a user into providing passwords or other personal information, downloading malware to the computer, or visiting a website allowing malware to be downloaded to a computer.
- Ransomware: A software tool that locks a victim’s hard drive allowing the criminal to ask for ransom. Ransoms can easily be in the six figures even for small businesses today.
- Social Hacking: Attacks that rely on human interaction, often via text, phone or email. Victims are tricked into different actions including sending money to the criminals, giving access to their computers to criminals, downloading ransomware or other malware onto their computers, etc.
Cybersecurity in Burlington | Sabre IT Solutions has a long time customer located in Burlington, Ontario that was the victim of a recent Phishing attack. This was in large part caused by staff who are innocently opening emails that are sent by cybercriminals. Because of their lack of knowledge, they ran the attachment which introduced the malware to their system. Our hardened environment was able to quickly contain the damage and we restored them to a working system that morning.
To Improve Manufacturing Industry Cybersecurity, End-User Training Needs to Focus on a Few Areas
- Passwords
- Company data
- Safety policies for email, internet, and social media
- Test end users
Passwords
Good password creation and hygiene are critical areas. Users should understand that complex passwords combining letters, numbers, and symbols are required today. Employees should be discouraged from using the same passwords for personal and work.
Company Data
Walk employees through data protection policies at the company. Ensure individuals are aware of the risks of releasing company data. Posting company information on social media can be used by hackers for social hacking and phishing attacks targeted at users.
Safety Policies for Email, Internet & Social Media Use
Set and communicate basic rules for the internet, social media, or non-work-related activities on company devices. On the flip side, ensure employees follow similar guidance when using personal devices to access work.
Hackers are using social media data more and more frequently for social hacking and advanced phishing. Employees need to be aware and avoid falling victim to bad actors. Ensure that they check with IT staff regarding anything flagged by antivirus software or that looks suspicious
Test your End Users
There are some good products on the market that can help you test your end-users and ensure they are not back-sliding. In addition, cybercriminals are constantly changing their approach to overcome people’s defences. Constant testing and training are critical to prevent hackers from getting the upper hand.
Harden Your Network with Patching and Maintenance
Maintaining a secure network is one of the most critical steps to ensure manufacturing industry cybersecurity. Outdated hardware and software create vulnerabilities that cybercriminals can exploit, making regular maintenance a must. Regular patching and updates are essential to protect your network from known vulnerabilities and reduce the risk of successful cyber attacks.
The Canadian Centre for Cyber Security is a government of Canada institution focused on helping Canadians prepare and resist Cyber threats in 2021. As we wrote this article, the home page had the warning:
ALERT: Canadian organizations exploited via unpatched devices and inadequate authentication
System Maintenance is Critical
System maintenance in today’s environment is one of the most important elements to harden cyber security in your organization. Bad actors are constantly trying to figure out how to get past our network security. The process of patching devices and managing proper authentication (like 2-factor authentication or 2FA) is not optional today. It is an absolutely critical step in running a business.
Patching often is ignored or deferred until it’s too late
Many small businesses are entirely unaware of how compliant they are with cyber security best practices. When we visit small businesses without an IT department, or who have part-time in-house IT or independent contractors we often find this area is terribly out of date.
Regular patching of your network is critical. Each device on your network, and every software product needs to be patched within a few days of the patch being available.
Why is patching so critical today?
It may seem like overkill to patch so frequently, but we need to do it because of the risks. The reality is that when cybercriminals discover an exploit, they rapidly expand their attacks. An exploit is usually part of the software (like Windows, or Adobe viewer) that allows hackers to bypass security. When companies prepare a patch for their products, the exploit has already been used to penetrate security.
The attack is active and out there. Waiting weeks or months to patch is like leaving your car unlocked for weeks or months.
Improve Cyber Security with Bullet Proof Disaster Recovery
Disaster Recovery is the term used to define the ability of a business to respond and recover from a damaged network, including from cyber-attacks. It is all about ensuring that businesses can continue to operate. As it related to cyber, it means the prevention, detection, control, and recovery from cybercrime.
BulletProof your Backups
Your backups are the most important part of your Disaster Recovery plan. There are other critical parts such as knowing where you will run your IT services if your hardware fails. In Cyber, you are unlikely to have physical damage to your computers. More likely, you have lost access to your network, or data. In most cases, recovering from a backup is essential.
A major change in cybercrime in the past 5 years is the move towards “lurking” cyber intrusion. This is when a cyber criminal gets access to your systems and rather than immediately attack, begins to monitor and attempt to sabotage your network quietly from the inside. They do this mostly to steal files and data, and to disrupt your backups.
You need to be unrelenting in your vigilance over backups. If they stop working, become suspicious. Make sure you test them occasionally to be sure they are working. Create an air gap (disconnect them from the network) and store them somewhere off-site. Use a Cloud Backup solution if you don’t have a 100% reliable team to create the air gap yourselves.
Cyber Disaster Recovery Plan
Create a Disaster Recovery Plan. Too many times we see businesses that have backups but didn’t really consider how they would need to use them. Days of wasted effort are spent before they can get back up and running.
Document
You need to know what your entire IT infrastructure looks like. Too many businesses actually don’t have a documented infrastructure and would need to rebuild from a catastrophic failure from memory. Create a list of all assets, which are critical, what systems and data exist and how do they interact with each other?
Response Plan
Have a response plan for a security breach. There are two parts of this. You want to have an operational plan: how to continue to operate while computer systems are unavailable. You also need a communication plan: under Canadian law, companies must report any breach that might cause the exposure of personal information of any citizen. This includes your employee files.
Have a Recovery Target
The last element of cyber disaster recovery is recovering your systems. In some cases, you may have fail-over equipment that can take over very quickly. In others, you may be restoring backups. Have a plan in place for where you are going to recover to, under what circumstances.
Disaster Recovery in Cambridge, ON | We recently encountered a prospective customer who had been hacked twice in a 12 month period by cyber criminals, and both times had found their backups non-functional. The first time resulted in a few days of lost work. The second time, over 4 months. Sabre IT is totally focused on ensuring backups are always working, and through highly advanced AI powered software we are constantly updated and informed of the state of all our customer’s backups.
Cyber Insurance
Last but not least. Be aware of your cybersecurity insurance situation. All companies should make sure they have cyber security coverage. More and more insurance policies are requiring all of these cyber security hardening actions to be in place and provable, Insurers are beginning to deny coverage to companies that do not take the risks seriously.
Businesses have gone bankrupt because of the lost business and inability to get back to work after an attack. They were shocked to find out that their insurance did not honour business continuity closes because of fine print related to cyber.
Cyber security insurance experts like Tripemco in Burlington, ON can review your coverage and ensure you are protected. You will need to provide proof of training, patching, backup reliability, disaster recovery, and good data practices.
Conclusion
Protecting your business against cyberattacks is a critical part of business today. The risk of this kind of damage to your company has been steadily on the rise throughout the 2010s. Now in the 2020s, this is one of the biggest threats to organizations in the Golden Triangle.
One of the best ways to harden cyber security in your business is with Managed Security from a professional IT consulting firm like Sabre IT Solutions.
In today’s digital age, everyone needs good cybersecurity training. Employees in many small and medium companies are unaware of the risks. Workers who simply don’t know how to protect themselves or their employer from cyberattacks are dangerous to your business.
We continue to see horror stories of businesses that are hit by attacks and have no backups. Either the backups have been neglected and stopped working sometime in the past, or the hackers disabled them. We frequently see inexpensive IT services that customers thought were fully protecting them, but in reality, did almost no preventive maintenance or monitoring.
Those businesses we talk to who were hit by an attack often have terrible experiences recovering. Days or even weeks of downtime as IT staff get equipment to replace their systems. Literally, re-keying data into their accounting systems from paper printed copies to catch up with months of last information.
The growth in attacks is very real. We see attacks against public organizations and government institutions in the news all the time. Private companies are just as impacted by this, but do not publicize it for obvious reasons. Most local business owners really have no idea how well their systems are protected and how strong their cyber security is.
Need Help?
If you are currently looking for manufacturing industry cybersecurity hardening, you should give Sabre IT Solutions a look. We have been providing manufacturing IT services for over 20 years. We regularly see the results of cybercrime that are attempted and stopped (for our customers) and that got completely out of hand and resulted in tragedy (with new prospects we meet all the time).
Give us a call at 226-336-6259 or contact us at itsales@sabrelimited.com today to learn more.
