Cyber risks for manufacturers

As manufacturing processes become increasingly digitised, the sector faces a growing threat of cyberattacks.

The 2020 Global Threat Intelligence Report (GTIR), produced by worldwide technology services company NTT, explores this landscape in detail. It uncovers the biggest risks faced by firms across the world today.

So what are the risks and how could cyber criminals exploit weakness in your systems? What action can you take to protect your business, from implementing security patches to taking out commercial insurance?

Read on for our guide to cyber risks for manufacturers, and recommendations for protecting your business.
 

Which sectors are most affected?

The latest figures on cybercrime paint a grim picture for many sectors.

In the UK, manufacturing is the most attacked sector, according to the 2020 GTIR. These industries account for almost one third of all attacks.

The second most attacked sector in the UK is technology, at 19% of all attacks; followed by business and professional services; government; and finance. Globally, the most badly affected sector is technology.

However, it is plain from the report that no industry is safe from cyberattacks. And in an increasingly connected world, the risks are continually growing.

What techniques do cyber criminals use?

Cyber criminals are upping their game, with many using artificial intelligence and machine learning to improve their attack methods.

The GTIR finds that cyber criminals are investing in automation techniques: globally, 21% of attacks involved a vulnerability scanner to detect weaknesses in business systems.

Reconnaissance activity was the most common threat for manufacturers, accounting for 60% of all attacks globally and half in the UK and Ireland.
That was followed by web application attacks, at 36% worldwide and 22% in the UK and Ireland.

Content Management Systems (CMS) are another common route for cyber criminals to steal business data and launch further attacks. In manufacturing, application-specific attacks against WordPress were notably high in the past year.

Manufacturers are making efforts to bolster their defences. However, many are not only struggling to keep up with these modern forms of attack, but are also failing to patch old vulnerabilities, such as the security bug HeartBleed.

Commercial insurance helps to protect your business from the damage caused by these crimes, such as forced downtime.
 

What are the biggest risks?

The most common crime linked to attacks on manufacturing is, perhaps surprisingly, intellectual property (IP) theft.

According to Deloitte: “Compared with more familiar cybercrimes such as the theft of credit card, consumer health, and other personally identifiable information, IP cyber theft has largely remained in the shadows.”

Innovation is at the heart of manufacturing. If cybercriminals steal your trade secrets, that could put you out of business and waste all your years of hard work and creativity.

As one manufacturer stated: “Most manufacturers are small to midsize shops that can’t weather the wholesale rip-off of their intellectual property.”
After IP theft, the GTIR found that the manufacturing sector is increasingly seeing financially motivated data breaches and threats to the global supply chain, too.

In fact, manufacturing is becoming the target of many different types of cybercriminals – and is failing to keep up with the increased threats.

Rory Duncan, Security Go-to-Market Leader at NTT, says: “UK manufacturing has become a major target for attackers in recent years as a result of the increased risks brought about from the convergence of IT and Operational Technology (OT).

“The biggest worry is that security has lagged behind in this sector, potentially exposing systems and processes to attack.

“Poor OT security is a legacy issue; many systems were designed with efficiency, throughput and regulatory compliance in mind rather than security.

“In the past, OT also relied on a form of ‘security through obscurity’. The protocols, formats and interfaces in these systems were often complex and proprietary and different from those in IT systems, so it was difficult for attackers to mount a successful attack.

“As more and more systems come online, hackers are innovating and see these systems as ripe for attack.”

With so many risks to their business, it is essential that manufacturers make sure they have commercial insurance in place to protect them in case of cyberattack.

The Internet of Things

Of particular relevance to the manufacturing sector is that attackers are increasingly exploiting the Internet of Things (IoT) as a route to the heart of the business that they are targeting.

Of course, manufacturing industries have been transformed by the IoT, or networked devices, in recent years. By enabling manufacturers to automate their business processes and increase the connectedness of their value chain, the IoT can increase efficiency, reduce hold-ups in the supply chain, and ensure high-quality products.

However, the downside is that this extended network of devices can act as a gateway to your IT systems. Many organisations do not secure them as well as other aspects of their network, making them a target for hackers.

One IoT cyberattack can halt your entire manufacturing process, causing you huge disruption and costs.
 

Phishing

No matter how well you secure your IT systems and networks, there’s still a weak link: the humans that use it.

Phishing, in the form of malicious emails opened by unwary employees or business partners, remains a common form of attack. People open an email that is disguised as being from a reliable source, and click on a URL or download an attachment.

This may then install ransomware on the business system, which is a variant on malware that encrypts an organisation’s data. It’s very hard to reverse the encryption process, so companies must pay thousands of pounds in ‘ransom’ to regain access to this vital information.

Most people are now aware of phishing scams, and don’t click on links from sources they don’t trust. However, cybercriminals are always evolving, and are getting much better at imitating emails from trustworthy sources.

It only takes one distracted, tired or unsuspecting employee to download an attachment – and create a route for cyberattackers to the heart of your business.
Training your staff and partners in spotting such emails is the best form of defence. Of course, it’s never 100% foolproof, so make sure you’ve got a robust commercial insurance policy, too.

You should also ensure all data is backed up in case ransomware attackers manage to encrypt it.
 

Supply Chain attacks

Your manufacturing business is very likely to be providing sensitive information to vendors, partners and others in your supply chain. It enables greater efficiency for everyone.

However, it also creates more risks, as it gives cybercriminals more opportunities to access your data.

In supply chain attacks, hackers gain access to your data via a partner or provider. They can then steal your own data and harm your business.
So take great care in sharing your data, and check the cybersecurity measures your partners have in place.

The fallout from Covid-19

While most of the data for the GTIR was gathered between October 2018 and September 2019, the report notes that cybercriminals are also taking advantage of the Covid-19 pandemic.

They are re-purposing toolsets, deploying new infrastructure, and proactively targeting organisations that are vulnerable in this time of global crisis.
One such method is phishing attacks that invite email recipients to download a map about Covid-19 outbreaks.

Another is to exploit the network security flaws that have sprung up as more people have taken to remote working from home.
 

How to avoid cyberattacks

According to Rory Duncan of NTT: “Now more than ever, it’s critical for all organisations, regardless of sector or region, to pay attention to the security that enables their business; making sure they are cyber-resilient and secure-by-design, which means embedding privacy and security into the fabric of their enterprise architecture and organisational culture.

The current global pandemic and the flow of trusted and untrusted information used to mask the activities of cyber criminals has shown us that they will take advantage of any situation. Organisations must be ready to respond to these and other threats in a constantly evolving landscape.”

So what does that look like in practice? The GTIR outlines the following ‘steps to success’ to ensure your manufacturing firm is secure by design and cyber-resilient.
 

Develop cyber-resilience

This includes:
 

• Developing a cybersecurity strategy with proper leadership support.
• Aligning security with business objectives using a common language of risk.
• Establishing a security mindset and ensuring that all employees know what they have to do.
• Identifying and mapping risks to your organisation’s most important assets.
• Designing and building solutions that are ‘secure by design’, making them harder to attack.
• Getting the basics right, and building additional capabilities on strong foundations.
• Using security monitoring to reduce ‘adversary dwell time’: the period between a breach of your security and its discovery, when hackers can cause damage.
• Ensuring you can respond in a proactive and adaptable way.
• Assessing your security capabilities, and using insights from reporting processes and metrics to adjust your priorities.

IT and governance

The GTIR calls the past year “the year of enforcement” due to the growing number of governance, risk and compliance (GRC) initiatives. To ensure your firm is handling data in accordance with the law, you should: 
 

• Gain an understanding of the data you have, deciding where it should be stored, who should have access, what you should use it for, why you need it, and how you should protect it.
• Employ the right people for the job. Make sure they are qualified and skilled data protection specialists. Engage trusted partners to work with you to transform data protection legislation into business practices.
• Implement strong data governance mechanisms. You need to manage the personal data you use in your business, and make sure you have got suitable controls in place.

Bolster your defences

To protect your business against the evolving techniques used by cyber criminals, the GTIR says you should:
 

• Pursue intelligence-driven cybersecurity. As threats grow ever more complex, your firm needs to change its mindset from a reactive one to a proactive one. You cannot eliminate risks entirely, but you can protect against them.
• Monitor the threat environment. You need to keep a close eye on the latest risks, using this knowledge to guide your decisions about maintaining an acceptable risk level.

Secure the Internet of Things

As your number of networked devices and connections increases, manufacturing businesses should:
 

• Build an integrated security ecosystem. You need to consider cloud and hybrid applications, too.
• Secure interactions of all kinds. Your users, including customers, partners and employees, are connected through different networks, all of which must be secured.

Protect your Content Management System

You should secure applications, especially by:
 

• Configuring your CMS services properly.
• Using strong passwords.

This will help to prevent hackers from getting to your website, your IT systems and your data.

How commercial insurance can help

The GTIR makes one thing absolutely plain: you cannot eliminate the risk of cyberattack completely.
 
Hackers are constantly developing new ways to exploit the tiniest weakness, using the very latest technological advances to do so.
 
And the IoT is increasing at an incredible pace, giving attackers even more opportunities to find a chink in your defences.
 
Although prevention is always better than cure, you should ensure that you have commercial insurance in place. That means that if cybercriminals do get past your defences, you can get help to recover the cost to your business.
 
That could include business interruption and loss of profits, as well as legal expenses.
 

Contact Insurance Choice today

At Insurance Choice, we understand how hard it is for manufacturing businesses to stay afloat today. There are threats from all sides, and they’re constantly evolving and growing more complex.
 
That’s why we have put together a range of competitive commercial insurance packages, including cover aimed at the manufacturing sector.
 
As well as cover for business interruption, loss of profits, and legal expenses, our insurance also helps to protect you from traditional risks. These include damage to buildings, tools and equipment, and goods in transit.
 
Our policies cover a range of trades, and can be tailored to your business needs.
 
Contact Insurance Choice today to give your manufacturing firm the very best protection.
 
Get a quote for commercial insurance today.

Policy benefits, features and discounts offered may very between insurance schemes or cover selected and are subject to underwriting criteria. Information contained within this article is accurate at the time of publishing but may be subject to change.