DBIR: Attackers Want To Steal Your Manufacturing Secrets

Connected devices and the internet of things (IoT) are revolutionizing the manufacturing industry, enabling manufacturers to achieve new efficiencies in the ways that they design, produce, and sell goods. While the latest technologies enable manufacturers to become more market sensitive, competitive, and efficient, these advancements also drive risk and demand that manufacturers pay more attention to cybersecurity.

Manufacturers face highly sophisticated threats to boot. The 2017 Verizon Data Breach Investigations Report highlights the threat of industrial espionage to manufacturers:

"Gains in strategic advantage via espionage-related actions comprise the majority of breaches within this industry. Most are conducted by state-affiliated actors, but instances of internal espionage pilfering trade secrets are present as well."

When it comes to research spend, manufacturing firms rank the highest with an average 4% of net sales being reinvested in research and innovation. Aside from being costly to conduct, these research and development efforts and their findings are a major source of competitive advantage for manufacturers. It should come as no surprise that competitors and new entrants often look to steal this intellectual property without spending a dime on R&D.

According to the recent 2017 Verizon Breach Report, 90% of data stolen in manufacturing was R&D data and intellectual property. The #1 motivation for these data breaches? Cyber-espionage.

The manufacturing industry also proved to be most susceptible to phishing attacks in 2016, with a phishing attack success rate of 13%. Retail and healthcare were the next most vulnerable to phishing, both with success rates of just about 10%. Take this in combination with the sophisticated adversaries and highly valuable IP inherent to the manufacturing industry and there’s a clear need for manufacturers to ramp up efforts to safeguard the information that is foundational to their competitive advantage and market success.

What can manufacturers do to safeguard themselves against such attacks and potentially devastating financial consequences? Here are four tips that manufacturers should follow to get started:

1. Understand what data is sensitive and where sensitive data is present in your environment – on endpoints, networks, and in the cloud.
2. Understand how that data flows within and outside of your organization and when it is at risk – is sensitive data being emailed out? Is it getting printed? Is it being moved to an unsecured network drive? Understanding your data, where it is, and how it moves as it is used enable you to prioritize efforts based on where sensitive data is at greatest risk.
3. Generate employee awareness – employees, whether through negligence or malicious activity, are your #1 risk to sensitive data protection. Emphasize employee cybersecurity education, from security awareness training on topics like avoiding phishing attacks to real-time notifications when they are engaging in risky activity. A vigilant employee base with sound security habits can lower a manufacturers’ risk of data loss or comprimse significantly.
4. Secure your supply chain – Third party risk is another important consideration for manufacturers; an insecure business partner or vendor can offer attackers an easy way into even the most protected environments. Vet third parties’ security posture before entering into business together and apply appropriate controls so that sensitive data is not egressed via third party channels.