Featured Image

Ransom and Then Some: A Cybersecurity Forecast for Manufacturing Technology

At AMT’s 2021 MFG Meeting and MTForecast Conference, Richard Mason, president & CSO of Critical Infrastructure, will share his insight on cybersecurity in the manufacturing industry.
Sep 10, 2021

At AMT’s 2021 MFG Meeting and MTForecast Conference, Nov. 2-5, in Denver, Colorado, Richard Mason, president & CSO of Critical Infrastructure, will share his thoughts and recommendations about cybersecurity in the manufacturing world.

A former member of the Secret Service’s New York Electronic Crimes Task Force, and a 20+ year veteran of technology titans AT&T, Lucent Technologies’ Bell Labs, and Honeywell International, Mason is an expert in the fields of cybersecurity, physical security, and enterprise resilience.

We asked him several questions about security to preview his presentation in November.

What is your overall cyber security forecast for Manufacturing Technology?

Mason: According to CrowdStrike’s 2021 Global Threat Report, manufacturing is a close second for the most targeted sector for ransomware-related data extortion, falling slightly behind industrials and engineering and ahead of the technology sector. These top three sectors will continue to be targeted due to their willingness to pay, the sensitivity of the manufacturing process to disruption, their relative immaturity of controls, and the potential supply chain security impact to downstream customers, networks, and data. And in response to this elevated threat, manufacturing companies can expect much greater scrutiny from government regulators, insurance underwriters, and their customers.

Where is the manufacturing industry particularly vulnerable in terms of cybersecurity threats?

Mason: I often hear from small to medium enterprises that they think they are off the radar of cyber criminals, that “there are bigger fish to fry.” But bait fish are used to catch trophy fish and enough bait fish can certainly make a meal. If your business is making money, has valuable data, or can be a steppingstone to a target that has more money and valuable data, then you are officially in-scope.

What are best practices for getting started with cybersecurity?

Mason: There are great (free) resources out there from the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (DHS/CISA) such as stopransomware.gov; the Cyber Readiness Institute’s program; and AMT’s member guidance on adopting the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF) is sound advice.

One best practice for getting started involves performing a cybersecurity maturity assessment using a trusted framework such as the NIST CSF. With a maturity assessment, a profile, and a plan (MAPP), you can start to answer fundamental cybersecurity questions: Where am I? Where am I going? Do I have the resources I need to get there? Is there a better or faster path? Are we there yet? A more targeted and lighter-weight approach would be a free ransomware readiness assessment to focus more exclusively on the controls that are related to ransomware.

Before you begin building out a cybersecurity program, I also recommend performing a tabletop exercise with key stakeholders. For example, it is possible that you already have a cybersecurity insurance policy — one that entitles you to certain incident response services and expenses, possibly even ransom payments. You will want to pressure test those processes with your insurance company, your legal counsel, IT, senior management, and law enforcement outreach services. If you are going to have ethical and legal debates on paying ransoms, determine what your maximum acceptable downtime is, how to communicate effectively with customers and authorities, or test whether your backups can actually be restored — do that before an incident, not during one.

For senior management, I’d advocate remembering PEMDAS (patching, encryption, monitoring, disaster response/recovery, asset inventory, and strong identity) to facilitate a deeper conversation on cyber security with your team. To better prepare your business for what’s ahead, register to attend AMT’s 2021 MFG Meeting and MTForecast Conference, Nov. 2-5, 2021, in Denver, Colorado. At this unique event, tailored to the manufacturing technology industry, you’ll hear more insight on cybersecurity and gain a deeper understanding of economic, market, and technology trends to help you build a robust business strategy.

Benjamin Moses
Director, Technology
Recent technology News
Apple, like Thomas Edison, has essentially created a business model in which they take the ideas of others (like almost every iteration of the light bulb), take credit, and get away with it.
Discover how MTConnect bridges the innovation lag between consumer tech and manufacturing. As a unifying open-source standard, MTConnect streamlines machine communications and fuels emerging tools like digital twins.
For once, history is useful. Hope we are not still paying for that. Is faster better? Printing the big stuff. Barriers to tech adoption.
Do you have a plan to prevent malware from infecting your computer system? Would you plug a random USB into a machine? Find out how to address these issues by watching Season 2 Episode 1 of “Smart(er) Shop,” an IMTS+ Original Series.
One of the biggest threats to a company’s cybersecurity is its employees. Promoting cybersecurity means focusing on reducing human error and promoting cyber hygiene.
Similar News
By Peter Zelinski | May 01, 2024

Formnext Chicago arrives next year. AMT's Doug Woods, Mesago's Sascha Wenzler, and Gardner's Peter Zelinski discuss the long road to this event, the importance of Formnext coming to additive's biggest market, and the competitive 2025 event landscape.

7 min
By Conchi Aranguren | May 24, 2024

Numerous investments and initiatives in Europe’s railway industry will sustain production for years to come. Spain’s automotive industry and the U.K.’s nuclear power sector see significant developments. For more industry intel and other tidbits, read on.

5 min
By Stephen LaMarca | May 24, 2024

Biorobotic hand can touch and feel. 0.000000952 seconds. Explosive design and manufacturing optimization. In keeping with the explosive theme... The difference between AI and AGI.

7 min