Globally, manufacturing has become a prime target for Cyberattacks. In Australia, the sector ranked in the top ten for cybersecurity incidents and top three for ransomware attacks in 2020-21.
In the late 20th century, the emergence of computer viruses and worms, such as the Morris Worm in 1988 and the Melissa virus in 1999, highlighted the vulnerability of interconnected systems and the potential for widespread disruption amongst businesses.
As personal computers became more widespread in the 1990s, so did the proliferation of cyber threats, including Distributed Denial of Service (DDoS) attacks, exemplified by incidents like the 1996 attack on the Panix ISP.
By the turn of the millennium, there was a rise of increasingly sophisticated attacks, such as the ILOVEYOU worm in 2000, which impacted up-to ten million Windows personal computers.
Other sophisticated attacks include state-sponsored cyber activities, like the 2007 attack on Estonia.
The 2010s witnessed a shift towards cyber warfare with the emergence of Stuxnet in 2010, a worm designed to target Iran’s nuclear facilities, and the escalation of ransomware attacks, highlighted by incidents like WannaCry in 2017.
Ransomware is a type of malicious software (malware) designed to block access to a computer system or data until a ransom is paid.
Between the 2020–21 financial year, the Australian Cyber Security Centre (ACSC) responded to around 1,630 cyber security incidents, averaging 31 incidents per week.
The ACSC classifies each incident it addresses on a scale ranging from Category 1, denoting the most severe, to Category 6, indicating the least severe.
Compared to the previous year, there was a 28 per cent decrease in total incidents, with no Category 1 or 2 incidents recorded.
Category 4 incidents increased, indicating a more significant impact on victim organisations, often involving data theft, extortion, or service disruption.
Category 4 incidents made up 49 per cent of reported incidents, a notable increase from the previous year.
Low-level malicious activities like reconnaissance, phishing, and non-sensitive data loss were the most common incidents, comprising over half of all cases.
Around a quarter of reported incidents affected critical infrastructure, including essential services like education, health, and communications.
Government sectors, followed by professional, scientific, and technical services, and healthcare and social assistance, reported the highest number of incidents.
Ransomware reports to the ACSC via ReportCyber increased by nearly 15 per cent, with around 500 reports received.
Additionally, the ACSC responded to close to 160 ransomware-related incidents. The professional, scientific, and technical services sector, along with the health sector, reported the most ransomware incidents.
Australian businesses faced significant financial losses due to Business Email Compromise (BEC) cybercrime.
While BEC reports saw a slight decrease compared to the previous year, self-reported financial losses surged, totalling approximately $81.45 million, marking a nearly 15 per cent increase.
Cyber-attacks in manufacturing have become increasingly prevalent as industrial systems become more interconnected and digitised.
Manufacturers’ Monthly spoke with Lesley Carhart to explore how manufacturers can develop the necessary skills to defend against cyberattacks.
Carhart, also known as hacks4pancakes, is the principal incident responder and threat analyst at Dragos, an industrial cybersecurity company.
Carhart is actively engaged in various cybersecurity topics, including industrial control systems, the SolarWinds hack, ransomware attacks, smart device insecurity, remote working, multi-factor authentication, and the 2021 Microsoft Exchange Server data breach.
“There’s a lot of legacy devices and networks in play that are doing very, very critical things in manufacturing processes,” said Carhart.
“Most large manufacturing organisations have global operations, and some of their most critical facilities are sometimes in less resource nations around the world.
“If there’s a compromise in one factory in one place in the world, it’s very likely to spread into other parts of the business network and financial network, in other manufacturing facilities.”
These attacks often pose significant threats to operational efficiency, product quality, and even physical safety.
Ransomware-related cybersecurity incidents were most reported by the professional, scientific, and technical services sector to ReportCyber in 2022–23, with the retail trade sector following closely behind, and then the manufacturing sector.
Together, these three sectors comprised over 40 percent of the reported ransomware-related cybersecurity incidents.
As reported by the ABC, the ransomware attack on JBS in 2021, allegedly carried out by Russia’s REvil hacker group, disrupted meatpacking operations at multiple plants for up to five days across Australia, the U.S, and Canada.
JBS had to shut down its 47 sites across Australia due to the attack.
The producer, which supplies a fifth of the world’s meat, experienced significant production and distribution interruptions, resulting in many non-union employees losing several days’ wages.
The meat-producer ultimately paid $14.2 million to the group.
Cyberattacks on supply chains can also pose significant challenges for manufacturers by disrupting operations, decreasing production output, and increasing costs associated with remediation and cybersecurity enhancements.
If businesses involved in supplying, manufacturing, distributing, or retailing products or services utilised by an organisation constitute a cyber supply chain, there will be inherent cyber supply chain risks stemming from these businesses.
Similarly, an organisation can pass on any cyber supply chain risks it carries to its customers.
As reported by CPO magazine, a supply chain attack on a business partner of Applied Materials, a major semiconductor manufacturing company, resulted in a $375 million loss due to disrupted shipments.
Although Applied Materials did not identify the affected partner, Bloomberg reported that MKS Instruments, which announced a ransomware attack on February 3, was the source.
Carhart explained that in most of their response cases, they encounter two groups of cyber attackers. One group is financially motivated, while the other group consists of insider attackers.
“Most of those are not intentional insiders,” said Carhart.
“There’s always this small percentile of people who don’t get a promotion, don’t get hired on their malicious contractors, and for some reason, they want to do something bad.
“But the vast majority of insider cases are people just trying to do their job.”
Carhart explained that insider attackers will often either try to accomplish something and encounter a security or process control that prevents them from proceeding as expected, or they’re simply bored and want to watch TV late at night.
“We see people hook up cellular modem, they hook up TV antennas, they connect USB drives other devices to the computer to do what they want to do, whether it’s some maintenance thing they’ve been told to do, or for personal entertainment,” Carhart said.
Carhart said that the sources of these insider attacks can be particularly difficult to locate.
“It takes time for those things to be detected,” said Carhart.
“Sometimes people find an antenna months and months later, even years later.
“Sometimes they find a connection plugged in that shouldn’t be there and at that point, it’s a matter of figuring out what was compromised. Can we trust the integrity of the network anymore?”
What can be done?
Carhart explained that to effectively manage cybersecurity, manufacturers must start with understanding their environment, including topology and asset inventories.
“I know a lot of groups make assumptions that they do have those types of information available to them, but they’re out of date, they’ve vastly changed over time,” said Carhart.
“I would start with very basic security hygiene things like, where are your network boundaries? What systems do you have in play? How old are they? Who manages them? And where do they live?
“After you figure that out, then you can start doing more architectural analysis, such as passive assessment of how you’re architected, whether you can segment things better.”
Secondly, Carhart said that businesses should form an intrusion plan in case of any potential ransomware attacks. Hindsight is key.
“That should certainly take the form of playbooks and documentation,” said Carhart.
“You don’t have to have a perfect asset inventory, a perfect network map, or a perfect incident response plan. But the more you have done in advance, the less miserable you’re going to be if you do have an incident.”
Lastly, manufacturers can benefit from updating their systems. However, as Carhart explained, this can be a difficult task.
“You’re at the mercy of your budget and your original equipment manufacturer (OEM),” said Carhart.
“When you buy process equipment, it’s warranted by the OEM to operate in a specific configuration and changing that can impact your process, production, and system integrity.
“It can also void the warranty, leading to loss of vendor support. Therefore, changes must be carefully planned during maintenance outages.”
If manufacturers are looking to bolster their business against cybercriminals, they can opt to do that internally, or they can consult a third-party.
But, if done internally, it can take time, said Carhart.
“You can do it internally—it takes time and human resources. It’s like using an open-source product; nothing is free. It requires human hours to do it,” they said.
“Alternatively, you can outsource this to organisations that specialise in consulting for OT systems, architecture, and monitoring and assessment.
“I would encourage you to use contractors or consultants that specialise in OT systems for your manufacturing facilities because dealing with those environments requires a lot more sensitivity.
“Either option is fine, but if it’s not done, and you have a crisis, you’ll have to do it at the beginning of the response.”
Carhart explained that in the event of a cyberattack architectural segmentation can slow down attackers, which can allow for more response time.
In cybersecurity, architectural segmentation refers to the practice of dividing a network or system into separate segments or zones, often referred to as security zones, based on the sensitivity of the data and the need for access control.
This segmentation helps to contain security breaches and limit the impact of potential attacks by restricting lateral movement within the network.
“I do see that architectural segmentation is vastly impactful, which can be everything from controlling remote access, putting multifactor on to just breaking the network up into segments,” said Carhart.
“This makes it a little bit more difficult for an adversary to move from facility to facility.”
Ultimately, by taking proactive steps to enhance cybersecurity resilience, manufacturers can safeguard their operations, protect sensitive data, and maintain trust with customers and partners.
In an increasingly digitised and interconnected world, cybersecurity readiness is essential for the long-term success and sustainability of manufacturing businesses.
The post Risk prevention in the digital age appeared first on Food & Beverage Industry News.
