Article by Avatara’s CEO, Rob McCormick, originally published in Industry Today.
Have you heard about manufacturing companies falling victim to costly cyberattacks lately? While I hope you’re safe, you’re probably not. Despite the continued publicity regarding high-profile cyberattacks on corporate giants, even the most sophisticated corporations aren’t taking the basic steps to stay secure. That realization became all too apparent this summer when telecommunications giant T-Mobile announced it had been hacked.
The breach exposed more than 50 million T-Mobile customers’ data. Hackers made off with addresses, Social Security numbers, birth dates, driver’s licenses, phone numbers, and other information to punctuate an identity theft nightmare. In consumers’ minds, lost data translates to lost trust. That’s just one of the detrimental business outcomes that victims like T-Mobile suffer.
Perhaps more importantly, extended downtime is at stake, which TSMC suffered when a hack cost it $170 million in operational disruptions.
Big-name databases aren’t the only ones at risk. As you know, manufacturers are in a time of digitization, sometimes referred to as Industry 4.0. So cybercriminals continue to consider the sector a high-value target. OXO International, Visser Precision, HanesBrands Inc., FACC, Renault Nissan, and Mondelēz International are among the manufacturing industry victims of the past few years.
It doesn’t matter how small your company is or whether you think your assets are attractive to cybercriminals. If you have processing power and a digital presence, you are a target.
I have four basic lessons to share that victims have had to learn the hard way. Now’s your chance to get ahead of an attack.
1. Keep equipment up-to-date.
“Don’t fix what isn’t broken” seems to make good sense in manufacturing. However, in an era of software-driven machinery, out-of-date systems may only work with older operating systems — and that can leave you vulnerable to an attack.
For instance, NPR reported on a computer that was controlling factory operations while running Windows 98 — and still connected to the internet. Outdated systems generally aren’t compatible with modern security patches and protections, which is why manufacturers need an IT vendor that specializes in complex and customized solutions.
2. Educate your employees about cybersecurity.
Cybercriminals are good at their jobs. Really good. They’ll bypass your firewall, endpoint protection, and other security measures by going after your users. You’d be shocked by how many Avatara customers click on the test phishing emails we send out as a part of security awareness training. Considering that 42% of cybercriminals gain entry through phishing scams, proper employee training can make a big difference.
And while you’re on the employee training train, it’s the perfect time to implement password policies, multifactor authentication, and other user validation protocols. You can never have too many layers of protection.
3. Don’t downplay data access control policies.
Keep data on a need-to-know basis. If someone doesn’t need a file to do their job, they shouldn’t even be able to access it. A 2021 Varonis report found that in the manufacturing sector, “every employee can access, on average, 6 million files on their first day on the job.”
Think about it: If an employee who has access to millions of files clicks on a phishing email, the results can be devastating.
Enforcing strict and consistent data exposure policies can go a long way toward preventing data breaches. Implementing these mandates will involve installing proper user permissions, clearing or archiving old data, and storing confidential data in a private, secure environment.
4. Get rid of ‘ghost users.’
Many manufacturing leaders don’t know about the prevalence of “ghost users” (i.e., former employees who can still log in to their company’s systems). The aforementioned Varonis report found that 44% of companies have more than 1,000 ghost users — and some of them could be disgruntled former employees who you’d prefer not having access to your systems.
Ghost users are also attractive targets for cybercriminals because their accounts are less likely to be monitored. Worse, IT decision makers often leave the accounts of recently departed employees active on purpose so their information can be easily accessed. That’s a breach waiting to happen. But rigorous “ghostbusting” can eliminate these security vulnerabilities.
Although cybercrime remains a serious threat to the manufacturing industry, so much of it is preventable with reasonable steps and consistent enforcement of best practices. By upgrading old systems, training employees, securing data, and controlling access, you can significantly reduce the threat of a breach.
