In this blog post, we’ll cover:
- Insider threat: The betrayal from within
- Data and Intellectual Property theft: Are your patents secure?
- Unmanaged and unsecured IoT devices: The digital wild west
- Ransomware: When your systems are held hostage
- Supply chain vulnerabilities: Test your vendors
- Phishing and social engineering: Avoid deceptive hooks
- Zero-day attacks: Beware of unknown gaps
- ICS attacks: Protect your industrial backbone
- DDoS attacks: Have a backup plan
- Lack of awareness: The threat of complacency
1. Insider threat: The betrayal from within
As the name implies, insider threats don't originate from external hackers but within the company. Employees with access to sensitive information such as design blueprints and intellectual property can become unwitting accomplices in espionage, or worse, they may be actively conspiring with external entities for financial gain, political motives, or sheer malice.
Insider threats can manifest in various ways, from disgruntled employees seeking revenge to those enticed by financial incentives offered by external parties or even state-sponsored actors seeking a competitive advantage.
Watch our on-demand webinar: A conversation with Carolina Angelis, one of Europe's most recognised experts in espionage and human intelligence
For example, in 2005, a US company established a profitable partnership with a Chinese wind turbine manufacturer, helping the latter grow into the world's second-largest producer. However, after signing substantial contracts, the Chinese company betrayed the relationship. They obtained intellectual property through an insider and caused the U.S. company to lose 80% of its business. This led to massive job losses and financial downfall.
All it took was one demotivated employee, a thumb drive and a Gmail account. And this happened almost 20 years ago when digital technology wasn’t what it is today.
How to prevent insider threat:
- Emphasize the importance of recognising and reporting suspicious activities to your staff.
- Implement strict access controls so employees can only access the specific data and systems required for their job roles.
- Continuously monitor user behaviour and network activities using advanced analytics and alert systems to detect anomalies.
- Establish a confidential whistleblower program with clear reporting channels and incentives for employees to report concerns.
2. Data and intellectual property theft: Are your patents secure?
Linked to insider threats, data and intellectual property (IP) theft occur when unauthorised individuals access and take valuable information they shouldn't. Data theft involves getting a company's private data, like finances, customer details, and production methods.
On the other hand, IP theft involves unlawfully taking a company's innovative creations, such as designs, patents, trade secrets, or unique technologies. For instance, there was a case where a long-time Pfizer employee, who was about to join a competitor, stole confidential documents, including some related to the COVID-19 vaccine.
How to prevent data and IP theft:
- Restrict access to sensitive data and intellectual property to authorised personnel using robust authentication methods.
- Encrypt sensitive data in transit and at rest to ensure its confidentiality in case of unauthorised access.
- Conduct regular security audits and monitor network activities to detect and respond promptly to potential threats or breaches.
3. Unmanaged and unsecured IoT devices: The digital wild west
Your company’s factory may have a sprawling assembly line filled with specialised robots and advanced technology that is purpose-built for automating tasks. However, unlike the robust security measures you probably have for office computers, these factory devices may operate in a less protected environment and may also be affected by vulnerable operational technologies (OT).
The challenge lies in keeping these IoT devices up to date, as they often run outdated software. IT teams and CISOs typically have less visibility into them than their corporate network counterparts.
How to minimise the threat caused by unmanaged IoT devices:
- Create an inventory of all IoT devices in your manufacturing environment. Classify these devices based on how important they are to your operations.
- Establish a patch management process to update IoT devices regularly with the latest security patches.
- Isolate IoT devices from critical corporate networks using network segmentation. This reduces the potential attack surface and limits their exposure to external threats.
4. Ransomware: When your systems are held hostage
Ransomware works like a digital hostage-taker. It’s a type of malware that encrypts a computer's or network's files and demands a ransom from the victim in exchange for the decryption key.
It typically infiltrates a system through deceptive emails or malicious websites, locking the victim out of their data until they pay the demanded ransom, usually in cryptocurrency. This is a nightmare scenario for any IT leader in the manufacturing industry because it disrupts production and can cause severe damage.
For example, Honda, one of the largest car manufacturers in the world, was hit by a ransomware called Snake. No sensitive data was exposed, but the attacks did disrupt Honda’s global operations and halted production.
How to prevent ransomware:
- Regularly back up your data.
- Train your team to recognise phishing emails and suspicious websites.
- Keep your systems and software up to date with the latest security patches.
If ransomware does strike, disconnect affected devices from the network immediately to stop the spread and report the attack to authorities.
5. Supply chain vulnerabilities: Test your vendors
Manufacturers typically operate in complex supply chains with many suppliers and vendors who may all have vastly different approaches to cybersecurity and information security in general. This exposes your company to more threats.
Supply chain vulnerabilities are weaknesses in your manufacturing network that cybercriminals exploit to infiltrate your systems. These threats arise from the interconnectedness of modern manufacturing, with suppliers and partners having access to your network. Cybercriminals often target these external entry points by injecting malware into supplied components or software.
How to secure your supply chain:
- Thoroughly screen and monitor suppliers for cybersecurity readiness.
- Conduct frequent supply chain audits and employ monitoring tools.
- Encrypt communications with suppliers.
- Develop a robust incident response plan to address breaches swiftly.
You might also be interested: Cybersecurity in Industry 4.0: Why manufacturing bears a quarter of all cyberattacks
6. Phishing and social engineering: Avoid deceptive hooks
Phishing is a cyber threat where malicious individuals or entities impersonate trusted sources, such as reputable companies, colleagues, or government agencies, to deceive individuals into revealing sensitive information or taking harmful actions. This is typically done through fraudulent emails, messages, or websites that appear legitimate but are designed to trick recipients.
For example, FACC AG, an Austrian aeroplane component manufacturer, lost around 50 million euros in a phishing attack called whaling. Criminals impersonated the company’s CEO and asked an employee in the accounting department to wire money related to a fake acquisition.
How to prevent phishing:
- Educate your employees to recognise and report phishing attempts.
- Use advanced filters to catch phishing emails before they hit the inbox.
- Add a lock to your virtual door with Two-Factor Authentication (2FA).
- Keep your systems and software updated.
- Establish a clear protocol for handling phishing incidents to enable swift mitigation.
7. Zero-day attacks: Beware of unknown gaps
A zero-day, also known as a 0-day, represents a hidden vulnerability or security gap within a computer system or software entirely unknown to its owners, developers, or anyone capable of addressing it. Until this vulnerability gets resolved, threat actors can exploit it for malicious purposes.
Zero-day vulnerability puts IT leaders in a tough spot, as there's no time to deploy a fix. Unmanaged IoT devices often cause such attacks.
How to avoid zero-day attacks:
- Keep an inventory of all your IoT devices. Know what's connected to your network.
- Stay on top of firmware updates and patches for your IoT devices.
- Implement strict access control measures to limit who can connect to your IoT devices.
- Invest in security monitoring tools that can detect unusual activities on your network.
8. ICS attacks: Protect your industrial backbone
Industrial Control Systems (ICS) attacks are sophisticated cyber threats that specifically target the critical infrastructure of manufacturing companies. These attacks aim to compromise the integrity, availability, or confidentiality of Industrial Control Systems, the backbone of industrial operations.
ICS attacks encompass other cyber threats, as they can happen through phishing, malware, and zero-day threats, among others.
How to minimise ICS attacks:
- Restrict access to critical ICS systems and data, limiting it to authorised personnel only, and employ strong authentication mechanisms.
- Isolate ICS networks from the corporate network through network segmentation to minimise the potential lateral movement of attackers.
- Develop and regularly test a comprehensive incident response plan to minimise damage and downtime in the event of an attack.
- Maintain regular backups of critical ICS configurations and data to ensure swift recovery and minimise disruptions.
9. DDoS attacks: Have a backup plan
In a Distributed Denial of Service (DDoS) attack, malicious actors attempt to overwhelm a target's online infrastructure, such as websites or servers, by flooding it with massive traffic. The goal is to disrupt the normal functioning of the target's systems, rendering them inaccessible to legitimate users.
How to avoid DDoS attacks:
- Deploy a Web Application Firewall to protect your website and other web applications from DDoS attacks.
- Strengthen your network security with firewalls and regular updates.
- Employ CDNs to distribute online content and absorb attack traffic.
- Use tools to detect unusual traffic patterns and anomalies.
- Restrict requests from single sources and filter malicious traffic.
- Have a worst-case scenario backup plan.
10. Lack of awareness: The threat of complacency
One of the most significant (cyber) threats is complacency. Your organisation should prioritise training and education at all levels, from top management to the factory floor.
Conduct regular training and raise awareness around cybersecurity and information security as a whole so everyone in the company is on the same page. Run audits to “take the temperature” at your organisation and see if there is space for improvement.
Awareness is critical to facing any cyber threat. While you may not be able to avoid an attack, you will be much better prepared to tackle it in a company-wide effort.
If you want to know more about securing information in your company, including relevant certifications such as ISO 27001 or NIS2, don’t hesitate to contact us.
