Winning at Cyber Security In Manufacturing
A Security practitioner will need a very thorough understanding of the business and the key business processes generally before tackling manufacturing in any case, as this is critically important.
Manufacturing Technology is very complex, it’s complex for the IT professional to understand because that environment is not the typical environment they are used to seeing. It’s complex for the business because they just want to be able to make whatever they want to make and send it along their supply chain path, plus it’s difficult for the Operational Technology (OT) engineer(s) because they are stuck in the middle trying to use their budget the best way possible, and having IT shouting at them because they aren’t conforming to standards, or worse, ignoring the area altogether and just pretending they aren’t there.
The outcomes for the business are usually clear, they want to manufacture the thing they need to manufacture and sell that thing, there are often regulations such as GxP for Pharmaceutical various regulations for Food production, Aeroplane manufacture, Water treatment etc. These regulations are either local in nature (country specific) or global (Industry specific) and usually differ in some slight way between each other and the requirements when it comes to the quality of the product.
There can also be requirements to track and trace the product through the supply chain, which can mean identifying the raw materials for manufacture through to the delivery of the product to the end customer.
Starting with those elements, there is clear complexity in the process, and that’s without the various processes required to build, maintain the equipment and make the product, plus there are often reporting requirements to be fed into an IT system, or a series of systems based on the location of the product or its raw materials in the supply chain.
This is where partnership really comes in, it’s not going to serve the business for IT (Information Technology) and OT (Operational Technology) teams to be arguing over who is right or wrong in whatever they need to do. There needs to be a common understanding between those two groups as to each other’s requirements and how they prefer to operate,. There needs to be pragmatism and flexibility on both sides to achieve the business outcome.