Alarming Signs on Operational Technology Cybersecurity

Protect – Ensuring that safeguards to manage the organization’s cybersecurity risks are used.

Detect – Ensuring that possible cybersecurity attacks and compromises are found and analyzed.

Respond – Ensuring that actions regarding a detected cybersecurity incident are taken.

Recover – Ensuring that assets and operations affected by a cybersecurity incident are restored.

The PMMI MaX Forum work document Bridging the IT-OT Gap on Cybersecurity compares the differences and compatibilities of IT and OT to help operators utilize both to effectively mitigate cybersecurity threats.PMMI

FSO INSTITUTE: Roman, do you have any additional thoughts regarding cybersecurity threats to food and beverage manufacturers?

HAVRIKIAK: A growing trend in the industry is the increased use of cloud-based services to support manufacturing processes. For example, IoT devices are becoming more prevalent in various operations, from security monitoring to process management. Many of these devices utilize cloud-based services to provide comprehensive capabilities. However, with the use of these devices, more and more operational technology (OT) data is exposed outside the organization’s firewall, thereby increasing the risk to both operations and data integrity.

Another example is the expanding use of external supply chains. Many manufacturing companies rely on Contract Manufacturing Organizations (CMOs) to supplement their internal supply chains, which requires the exchange of manufacturing data, including recipe information and other intellectual property. Statistics show that almost 60% of data breaches are caused by compromised suppliers or third-party partners. Without proper consideration of a third party’s cybersecurity practices, there is significant risk. In fact, attacks on third parties often aim to “tunnel” into another company’s network through weak security between partners.

FSO INSTITUTE: From your own experience, what have you found to be most effective in bridging the gap between IT and OT in order to prevent and/or respond to cyber threats?

HAVRIKIAK: Robust governance ensures a holistic approach to addressing enterprise risks. This area is often the least mature within cybersecurity management and is one of the more challenging aspects to address. Since cybersecurity involves all parts of the organization, it requires a cybersecurity structure that reflects this extensive threat surface. Traditionally, a company’s cyber organization is fragmented across various business lines and layers, which generates inconsistencies and potential gaps in the enterprise’s security defenses. Consolidating such an environment into a unified enterprise cyber culture is a difficult task.

Another challenge is that IT cybersecurity is typically more mature and better understood than the company’s OT environment. A company’s IT systems have been traditional targets for many years, and as a result, IT vulnerabilities are well recognized, with mitigating solutions readily available. OT architectures, on the other hand, are less understood and often rely on separate technical organizations—such as the engineering department—for support. Furthermore, IT and OT often report to different organizational units, leading to separate strategies for managing cyber risks.

By establishing an enterprise-wide cybersecurity organization that potentially employs a Defense-in-Depth (DiD) type of approach, many of the concerns related to OT and IT can be effectively addressed.

FSO INSTITUTE: Can you describe an actual cybersecurity experience using the NIST model?

HAVRIKIAK: A significant incident occurred between a manufacturer and a key vendor, both of which had implemented robust NIST-based cybersecurity frameworks. Governance was established, cybersecurity risk management strategies were in place, and business risks were understood. Safeguards were implemented to protect assets, with risks identified and priorities defined. Vendors were screened as part of a cybersecurity audit before sharing any data.

During a routine Dark Web surveillance, it was discovered that the vendor had suffered a compromise, and data was being offered for sale. This triggered a cyber incident response process, bringing together key stakeholders to triage the incident. The goal was to identify vulnerabilities to the manufacturer and secure affected assets, including reviewing integrated systems and understanding shared data.

After the triage, the manufacturer decided to disconnect all interfaces and disable accounts related to the vendor, impacting over 70 systems. The manufacturer then contacted the vendor to understand the breach. They identified it as confined to one cloud service, where credentials to a storage bucket had been compromised. The threat actor was expelled, and the environment was restored from backups. Agreements were reached to destroy the exfiltrated data.

In summary, the NIST-based frameworks enabled both companies to effectively respond before any significant business impact occurred.