Cybersecurity means bottom-line business - Putman Media
Accounting firm Wipfli is expanding cybersecurity services to manufacturers, helping them address vulnerabilities that threaten production and revenue.
Cybersecurity is gaining recognition as a business, finance and insurance issue, prompting responses from a wider circle of professionals beyond traditional IT security teams. Accounting and advisory firm Wipfli has expanded its services to help mid-level manufacturing clients address cybersecurity challenges that often haven't been properly evaluated yet.
If an enterprise resource planning (ERP) system locks up due to a cyber-attack, a manufacturer can still produce its product. However, if its operations go offline, production stops, and this immediately becomes a revenue and business-risk situation.
Legacy equipment vulnerabilities
Manufacturing systems generally have less mature cybersecurity capabilities than business-level IT systems, and manufacturers must contend with large amounts of very old equipment. These devices have reliably generated products and profit for decades, but if they run software, it's typically 15-20 years old with known vulnerabilities that weren't addressed due to lack of applicable cybersecurity requirements at the time.
Wipfli's advisory role now includes helping users conduct vulnerability assessments of components, processes and networks, and perform cybersecurity scans. The firm advises on both offensive and defensive strategies, checking exposure to physical, logical and socially engineered cyber-intrusions.
Real-world assessment example
Wipfli recently performed a vulnerability assessment for an electrical components manufacturer, scanning equipment with Nessus Pro software, identifying unpatched software, and evaluating cybersecurity policies. The assessment revealed critical issues: laptops running specialized testing software weren't patched and couldn't handle vulnerability scans.
The testing software locked up while motors were running at 100%, creating an overheating situation that almost started a fire. The client had violated its own policy by allowing specialized software on the office network rather than the operations technology (OT) network.
When a user has critical and potentially vulnerable software, they must also know the procedure for monitoring what parameters are running outside that may impact that software.
Network segmentation strategies
Following the assessment, Wipfli's client relocated testing software to its OT network, added a continuous vulnerability-management system, tightened physical control over assets, and properly isolated networks. Wojcinski outlines basic steps manufacturers can take to segment their networks effectively.
These include inventorying all production components, updating asset records, segmenting OT networks from business IT networks using managed Ethernet switches as firewalls, adopting cybersecurity standards from organizations like the Center for Internet Security, and performing thorough vulnerability scans and penetration testing.
Manufacturers also need to develop backup and recovery policies that can restore production capacity. "Developing a process map can identify critical equipment, workstations, SCADA systems, PLCs and other controls, and network links," explains Wojcinski. "Users want to know if they'll have the right information to get up and running again in a timely fashion."
Related
