Why is cyber security so difficult in industrial environments? And what to do about it

As industrial and manufacturing businesses undertake digital transformation initiatives, they stand to drive efficiency, improve productivity and achieve new competitive advantage.

However, as digitalisation progresses, they also expose a new risk: a growing surface which is vulnerable to cyber-attack.

Digital transformation promises much reward to businesses of all sizes and in all sectors. In industry, the concept of Manufacturing 4.0 sets a new vision for manufacturing, utilities and other industrial companies – one in which resources are optimised, efficiency is continually improved, data drives decision making and predictive analysis helps to deliver serious competitive advantage.

However, alongside all the promises of Manufacturing 4.0 and industrial digital transformation, new risks are brought into the equation – not least the growing cyber-security risk.

Why is cyber security so difficult in industrial environments?

Many industrial and manufacturing sites have aging computer hardware and software which hasn’t been touched in years. The philosophy of “if it’s not broken, don’t fix it” was fine when these computer terminals and control systems were standalone islands of technology.

In today’s interconnected world, where the flow of data makes it necessary to connect these legacy systems to the wider corporate network, it is no longer acceptable to be running an unsupported Windows operating system or fifteen-year-old software.

As well as connecting these legacy solutions, many industrial sites are fast-tracking their digitalisation projects by adding new devices and sensors to the network. Cheap sensors, counters and metering can fill the gaps in data acquisition and help to create a better digital picture of what’s happening in the plant or on the shopfloor. 

At the same time as enhancing operational information and visibility, this plethora of new, connected devices also serves to expand the potential attack surface. Do these devices have the necessary security capabilities? Have they been installed with the default security settings? Could they be the new weakest link in the site’s cyber security?

This complex picture of multiple devices and aging systems makes cyber security a particular challenge when pursuing digitalisation in industrial environments.

The elevated cyber risk in industrial environments

Cyber security needs to be at the forefront of any digitalisation initiative, but this is especially true in legacy manufacturing and industrial environments.

A cyber-attack can be devastating in a services business. It can halt or disrupt operations, leading to significant financial losses. It can cause serious reputational damage. It can result in data leaks of personal information, impacting individuals’ privacy – and lives, potentially – and causing significant reputational to the business. And it can result in large fines from industry regulators.

In an industrial environment, a cyber-attack can have all these side effects and more. 

For utility operators, it can result in disruption to the supply of critical services – with a resulting downstream impact for thousands of businesses and/or millions of customers. For manufacturers, it could result in dangerous working conditions, accidents or sabotage – with huge impacts on staff, the facility, the wider environment and/or consumers as well as profit.

When a cyber-attack could result in a serious chemical leak, an explosion or businesses unable to operate for hours or days, the heightened risk makes good cyber security practices more important than ever.

How to boost cyber security in industrial environments

Creating a data platform between the shopfloor equipment and devices and the business systems, such as ERP, is a common way to digitalise in industrial environments. This way, the operational technology (OT) and conventional IT worlds can be integrated and the data generated by shopfloor systems be used to deliver advanced insights and enable data-driven decision making.

Before connecting aging systems and software to such a data platform, they must be upgraded to the latest operating systems and software patched to mitigate the latest security threats. Not doing so creates an opportunity for hackers to exploit known vulnerabilities. 

If it isn’t possible to update and upgrade these systems, they must be replaced before any connectivity to the wider business network and systems is considered or actioned. 

Any supplementary metering, sensors or other connected devices should be selected with a clear understanding of their cyber security capabilities. Can they be password protected? Do they support data encryption? How easy is it to update or change security settings? Does the company provide regular security patches? How easily can they be applied?

They should also be installed with password protection – don’t rely on out-of-the-box settings or passwords!

Automated patching is the best way to ensure systems are up to date and remain secure. Working with a cyber security specialist can be beneficial, especially for testing and reviewing the cyber security of the network and all connected devices on a regular basis. 

While safety and security are paramount in all businesses, industrial environments do present elevated risks and face particular challenges. With good planning and management, however, there is no reason why cyber security cannot be managed just as successfully as within any other environment.

What next?

If you have questions about securing your environment, please get in touch with our team. We’re always on hand to offer intelligent advice.

Call us: 0808 164 4142

Message us: https://www.grantmcgregor.co.uk/contact-us 

Further reading

You can find more information and advice about cyber security on our blog:

• Is your business data at risk? Don’t take chances with old tech
• Cyber security update: 2023’s phishing tactics
• What can we learn from the NCSC’s sixth Active Cyber Defence report?
• The problem of shadow IT – and how to get the human factor right in cyber security
• Cyber Crime on the Rise: how can you protect your organisation from it?
• What is a watering hole attack? And how can you protect against it?