Board directors continue to up their investment in cybersecurity. Seventy-three percent  now say their organization requires that third-party vendors meet certain cyber risk requirements—up 30 percentage points from 2016, according to the 2018 BDO Cyber Governance Survey of 145 co-directors at public companies.

This increase in requirements and investment is warranted as manufacturing companies adopt and integrate more advanced technologies into their operations. During 2018, we have seen a 350% increase in ransomware attacks, a 250% increase in spoofing or business email compromise (BEC) attacks and a 70% increase in spear-phishing attacks in companies overall. Further, the average cost of a cyber-data breach has risen from $4.9 million in 2017 to $7.5 million in 2018, according to the U.S. Securities and Exchange Commission.

To further complicate the cyberthreat landscape, the threat actors are increasingly integrating their efforts between nation-state cyberattack groups, criminal cyberattack groups and hacktivists, resulting in more sophisticated cyberattacks on manufacturers—especially companies tied to critical infrastructure industries.

Manufacturers must focus on three key aspects of cybersecurity:

1. Protecting their business information systems, including email.

2. Guarding their manufacturing information systems , including computer-aided-design and computer-aided-manufacturing (CAD/CAM) systems, as well as securing production machinery.

Managing Risk

Threat-based cybersecurity should be the North Star for manufacturers. Instead of focusing solely on protecting critical data assets or following the basic script of a cyber program such as ISO 27001 Information Security, this predictive approach concentrates investments in the most likely risk-and-attack vectors based on each manufacturing company’s unique threat profile.

To develop and maintain a comprehensive cyber threat profile, you first need to assess and take ownership of your organizational DNA: the data assets and other intellectual property that make your company unique—or a potential target. This involves identifying, managing, accurately categorizing, protecting and optimizing organizational data from inception to final disposition.

As you go through this process, it is important to realize that the data assets you value the most may not be the prime target for a would-be hacker. Your data on performance outcomes, for example, is far harder to monetize on the dark web than product designs, client account information or supplier information.

The next step is to factor in the threat environment to understand current exploits and the most targeted vulnerabilities. The most targeted cyber-attack vectors include email system attacks focused on gaining system access and/or re-routing payments, supply chain attacks and insider-threat attacks.

What does this tell us? To effectively detect and respond to cyber and data privacy risks, manufacturing organizations need to:

Conduct advanced email and network attack detection assessments. This will help you diagnose the real state of your cyber defense to advanced persistent threats on your email system and information/data network

Bolster access controls. Evaluate technical policies, plans, and procedures to protect vital information assets, including implementation of data encryption, multi-factor authentication (MFA), and developing a layered–cyber defense system

Create an incident response plan. Include the participation of organization leadership and key personnel from all areas of manufacturing, information technology, business administration and engineering operations

Create an internal and external crisis communications plan. This should align with existing enterprise risk management frameworks

Strengthen monitoring, detection and response services. The goal is to quickly detect cyber intrusions and data breaches, rapidly respond to cyber-attacks and effectively eradicate malicious software.

Evaluate cyber insurance liability coverage to be sure it’s adequate to cover a significant cyber data breach.

Threat-based cybersecurity is a journey spanning the entire corporate lifecycle and requiring an ongoing commitment to cyber defense. Given the growing risk of cyber and data privacy attacks, it is vital to begin developing an approach.

Source: Industry Week

Polk & Associates

Large enough to serve a diverse clientele, yet small enough to maintain a hands-on approach, we are committed to maintaining the highest accounting and ethical standards with continuous education, extensive research resources, and excellent quality control.

Polk and Associates is a member of the Michigan Association of Certified Public Accountants, and the American Institute of Certified Public Accountants. The firm participates in the AICPA Peer Review Program, and has always received the highest level of award for its audit practice and quality control.