This website uses cookies primarily for visitor analytics. Certain pages will ask you to fill in contact details to receive additional information. On these pages you have the option of having the site log your details for future visits. Indicating you want the site to remember your details will place a cookie on your device. To view our full cookie policy, please click here. You can also view it at any time by going to our Contact Us page.

Close

Be smart and protect your data

12 September 2021

Umair Masud and Sherman Joshua explain how and why it is important for food and beverage companies to connect their facilities while at the same time protecting their data. 

Food and beverage producers are implementing smart manufacturing at a rapidly accelerating pace in order to benefit from connectivity and the opportunities it provides to gain better insight into production processes; improve food-safety visibility and practices; and resolve or help prevent food-safety issues. However, greater connectivity  brings with it a downside – greater vulnerability due to insufficient cybersecurity. 

Security threats now come in more forms than ever before: physical and digital, internal and external, malicious or unintentional. Food and beverage companies could be targeted specifically with threats tied directly to food safety and the integrity of the nation’s food supply. All potential threats pose significant risks to food and beverage operations, brands, and the consumers they serve. 

More stringently regulated industries were forced to connect and grapple with increased security needs much earlier than other industries. For a time, the focus among many food and beverage producers remained on more traditional, physical security considerations associated with food safety and quality. Now, many companies are taking a fresh look at their security approach to make it comprehensive and cohesive in a connected environment. 

A risk-based approach 
Cybersecurity is a journey – there is no catch all solution to creating a permanently secure environment so it is important to introduce a variety of capabilities and controls to enable a rapid response, and to respond and adapt, to emerging and evolving threats. 

A risk-based approach will identify the unique people, process and technology-related risks an organisation faces and implements policies and procedures to address them. This gives the flexibility to right-size efforts and allocate the right resources to mitigate risk down to the acceptable level for a particular organisation. 

Done right, this approach offers value beyond the most obvious security implications – it also fuels improved productivity and helps prevent unnecessary losses. With cybersecurity programs in place, producers have better visibility into their full range of assets, as well as the ability to identify and correct issues more effectively. As an example, when engineers have remote access to a PLC in a production environment, it’s a benefit that helps sustain productivity levels. However, without the right controls in place, an engineer could access the wrong PLC, causing unnecessary disruption and inhibiting productivity. 

So, how can producers evaluate their existing security program and find ways to take a more comprehensive, risk-based approach? There are three key areas to consider – the company’s cyber hygiene, a defense-in-depth strategy, and planning across the attack continuum.

Cyber hygiene 
For food and beverage producers who may be in the early stages of updating their cybersecurity practices, cyber hygiene offers a natural starting point. 

Addressing four key programmatic areas can help an organisation establish a base level of cyber hygiene. 

• Conduct a thorough inventory of the assets connected on the plant floor – as well as their known vulnerabilities. This asset inventory must be maintained and updated regularly. 
• Create programs to address the assets’ known vulnerabilities, patch regularly and confirm that mature processes are in place to make and track configuration changes. 
• It is important to employ backup and recovery mechanisms for all critical assets. This helps make sure a known good backup is on standby and can be accessed quickly. 
• Finally, completing regular risk assessments allows an organisation to measure and manage risk on an ongoing basis. These assessments provide the most up-to-date view of the level of risk the organisation is exposed to and the resources required to mitigate it. 

These are fundamental steps that build a cybersecurity foundation from which it is possible to continue to build. While maintaining proper cyber hygiene is essential, a connected organisation will want to go further to develop a more robust cybersecurity program implemented across all operations. 

Defense-in-depth 
A security-through-obscurity approach no longer offers sufficient protection against today’s wide array of threats and threat actors. It is necessary to build its security around the idea that any one point of protection probably can and will be defeated. A defense-in-depth strategy will create multiple layers of protection through physical, electronic and procedural safeguards. In the event of a threat, there will be more than one line of defence in place. 

There are six primary components in a defense-in-depth strategy – policies and procedures, physical, network, computer, application and device. While every company will have a unique security strategy, each of these components will have a role to play in the effectiveness of the overall approach. 

Policies and procedures address the human side of security, helping shape employee behaviours – and to confirm that security practices are followed, and technologies are used appropriately. Physical security limits facility access among both external and internal audiences. For personnel, access should be tightly controlled, limited not only in terms of areas within a facility, but also to entry points on the physical network infrastructure, such as control panels, cabling and devices. 

The network security framework should be developed through close collaboration between Information Technology (IT) and Operational Technology (OT), working together to identify and implement the right technologies and policies. These technologies likely will include an industrial demilitarized zone (IDMZ), which separates the enterprise and industrial zones and helps to manage access and monitor traffic. 

The computer component is vital, as software vulnerabilities represent the top means of intruder entry into automation systems. Patch management, antivirus software, application whitelisting, and host intrusion-detection systems are specific measures that help harden computer assets. At the production application level, security devices are needed to restrict both physical and digital access. 

Finally, devices represent the last area of defense-in-depth security. Consider deploying device authentication and unauthorized device identification as well as modifying default configurations for embedded devices. 

Much of this defense-in-depth approach is focused on proactive, defence measures that prevent threats from fully manifesting. However, it also is important to investigate and prepare for the entire lifecycle of potential threats, including those that may escalate into a security incident. 

Attack continuum 
The most robust and effective cybersecurity program will address each phase of the attack continuum – before, during and after an attack occurs. The steps and activities detailed above relate directly to the before phase, when it is important to focus on the identification and protection of assets, both IT and OT. A thorough, frequently updated risk management plan and a robust cybersecurity program will put an organisation in the best position to minimise the occurrence of attacks. 

Of course, constant vigilance is necessary in the face of the increasingly complex and evolving threat, landscape. Systems need to be in place to monitor for and detect any network behaviour that does not conform to the expected patterns or baseline, equipping them to react, adjust the system and impede potential threats during an attack. 

After an attack, the top priority is helping to ensure safe production and minimising downtime as a result of the cyber-attack. Risk management plan should include processes for containing an attack, eradicating the effects and recovering rapidly. The plan also should outline steps for a post-incident investigation with the goal of identifying root causes and means of strengthening resilience. 

Traditionally, food and beverage producers have focused on the physical security measures that promote food quality and safety, protecting consumers and stewarding food supplies. In today’s connected environment, however, physical security and cybersecurity are inextricably linked. Now is the right time for organisations to confirm that they have a robust cybersecurity program to mitigate the broader spectrum of potential risk and threats. Applying the same rigour across physical and cybersecurity programs will put a company in the best position to protect people, brands, reputations and financial interests.

Umair Masud is portfolio manager for Consulting Services, and Sherman Joshua is global marketing director for IIoT Services at Rockwell Automation.


Contact Details and Archive...

Print this page | E-mail this page