Topics:
In the past, manufacturing environments weren’t about shared infrastructures nor about sending valuable process and business data to third parties for analysis and storage. The cloud, however, has fundamentally changed that.
Digital transformation has come to manufacturing for many good reasons, foremost among them is sending the lakes of data produced by existing and newly connected devices to a third-party platform for deep analysis that can uncover and inform how to best improve processes and identify areas that require attention before expensive operating faults occur.
The cybersecurity side of this equation, however, is by its nature often at odds with digital transformation. Security leaders will cite the nebulous “increased attack surface” presented by the cloud, and fret about increased risk due to the introduction of now connected vulnerabilities that were uncharacteristic of isolated industrial systems. Progressive security leaders and key decision makers cannot simply say no to OT and the cloud but instead must find a strategy to mitigate the risks introduced by digital transformation with the integration of IT and OT in order to unlock the rich data value once connected.
Here are a few suggestions—from my prior experience—where a well thought out cybersecurity ecosystem can identify and reduce risk, and well align with the business, IT and operations.
IIoT is the foundation of digital transformation within manufacturing, connecting physical devices and digital industrial systems with IT to identify process inefficiencies, increase plant automation and improve business operations. IIoT devices such as sensors and actuators at Level 0 of the manufacturing Purdue Model facilitate the transfer of data up to controllers and human-machine interfaces (HMIs) to be collected and then passed up to a cloud-based platform. It’s there where aggregated data is analyzed, modeled and real-time performance insights on individual devices or production lines are developed and then delivered to plant floor operations.
While these are often huge wins in terms of cost savings and process improvements, manufacturing plants, regardless of industry, must also now account for and mitigate the cybersecurity risk that IIoT and the cloud introduce. Cybersecurity research groups such as Team82 have demonstrated, for example, how an attacker can leverage a connected device to compromise a cloud management account, and of course the risks a vulnerable cloud platform poses to the devices it manages. This brings the theoretical possibility quickly into reality.
Let’s talk about some of those risks and what one can do to offset or mitigate their impact.
Cloud platforms that receive, manage, and analyze IIoT data are accessed remotely by their nature. Asset operators remotely access, monitor, and troubleshoot industrial devices through these platforms. Like traditional IT, this type of access must be securely guarded.
Any poor configuration or weak access control policy opens the door to an attacker looking for an easy entry to disrupt or damage an organization. Attackers need a way in, and stolen credentials, phishing, or weak or default passwords simplify things immensely for someone seeking illicit access. Locking down remote access should not be a mystery to anyone in 2025. Supplement passwords with multifactor authentication. Implement a trusted secure access solution for OT environments, one that allows for real-time shoulder surfing of remote sessions, logging and auditing capabilities that facilitate not only security needs but meet compliance requirements. Providing either a VPN or a jump server isn’t enough anymore with modern inter-connected networking, nor are many off-the-shelf, non-enterprise grade remote access tools. A purpose-built tool fully considering OT environments is a must.
Segmentation closes many doors enabling lateral movement. Whether it’s an attack that compromises the IT/business network or the cloud, it’s critical to contain and isolate an attacker before they can move deeper onto critical production systems. Lateral movement is squashed through properly segmented networks and layered network architecture of industrial control systems, manufacturing IT and enterprise IT. Period.
Segmentation also reduces the number of potential targets available to an attacker and reduces overall production risk immediately. It has many overall security advantages, including the ability to implement granular access controls for each network segment, limiting who has privileges; it’s also a key enabler of building in a zero-trust architecture. Monitoring can also be improved and simplified through segmentation, allowing for the recognition of anomalies and potential malicious traffic activity in real time.
The layered, segmented isolation of critical systems also satisfies certain industry regulatory requirements through segmentation.
It’s important to have visibility to the traffic/data shared with your third-party suppliers, supply chain providers and partners, and that extends to the cloud as well. IT service providers have their own extensive supply chains, components, and APIs that make up their operating platforms and infrastructure on which your data is transmitted to and analyzed. It can be compromised as well. It’s important to understand the security posture of your providers and implement sound policies and mitigations in order to reduce risk to your data and manufacturing in order to prevent disruption or manipulation of information or potential impact to operating manufacturing plants.
OT was never designed with IT connectivity in mind. Many industrial-focused systems currently in production within factories and other manufacturing facilities still rely on OT devices and systems designed decades ago that were meant to be stand alone, air-gapped from IT business networks and certainly the internet. Cloud integration and modern security applications were not part of the equation two-to-three decades ago.
Asset operators and security teams should start with the legacy protocols handling communication of data between devices, databases, and the cloud. Modbus, for example, is a widely used industrial communication protocol and at its core lacks authentication capabilities, encryption for data security, and integrity checks verifying data sources and that both ends of a connection are legitimate and secure. Most industrial communication protocols which number close to a hundred in total do not have security mechanisms built into their protocol stack.
Attackers in a man-in-the-middle position can steal data as it crosses these plaintext protocols, and with some understanding, could inject malicious control system code (i.e., Stuxnet) that disrupts or damages a process or puts human safety at risk.
Firmware updates ensure that devices are current. Whenever possible, organizations should adopt modern secure industrial network protocols such as OPC UA, Ethernet/IP or Modbus/TCP which includes transport layer security.
Modern manufacturing is moving data to the cloud to unlock value and gain operating efficiency. It’s inevitable if it’s not already happening in your organization. You must assess the security of your data management processes and the information that’s sent outside your organization’s perimeter for analysis and processing. The business demands the efficiency, improvements, and cost-savings that the cloud enables. As security professionals, we should not say no to these business demands, instead, we must find a way to comply with a secure inter-connected ecosystem that doesn’t put the business or manufacturing at risk. The good news is it is totally possible and has been successfully implemented at even large firms, at scale.
Jim LaBonty is the retired Director and Head of Global Automation Engineering for Pfizer's Global Engineering & Technology division. In this role he primarily focused on establishing the strategic direction and harmonizing control system solutions across 42 manufacturing sites globally, including securing the development of Pfizer's COVID-19 vaccine. Previously, LaBonty held senior engineering and system architect roles at Rockwell Automation, Eli Lilly & Company, and Eastman Kodak Company. He now leverages his decades of experience to help firms with their corporate OT cyber strategy and global program execution, with the goal of protecting manufacturing.
