In an increasingly interconnected world, threat actors have recognized the immense leverage they can gain by targeting services that are vital for sustenance, such as food, water or energy. This realization has driven cybercriminals to develop a deeper understanding of operational technology and industrial control systems in manufacturing. As manufacturers deploy automation and cloud-based technologies to bridge the gap between IT and OT networks, they must acknowledge and address the serious cybersecurity risks associated with this convergence.

The adoption of smart manufacturing technology, which integrates IT and OT networks, is on the rise. Recent studies indicate that 84% of manufacturers have embraced or are actively considering smart manufacturing applications, including smart devices, asset performance management, production monitoring, and distributed control systems. These tools facilitate process automation and digital transformation, enabling manufacturers to optimize production and address workforce challenges.

Digital cloud technologies that bridge IT and OT networks facilitate seamless information exchange between systems and assets, automating various aspects of production. To take advantage of these developments, manufacturers must prioritize the digitization of manufacturing execution (MES), quality management (QMS) and other core business systems. However, they often overlook the significant security risks associated with deployment of these applications and connecting IT and OT networks.

While manufacturers grapple with internal challenges such as quality and growth management, and external obstacles like inflation and supply chain disruptions, cybersecurity risks posed by digital transformation and new technologies often go unnoticed. Surprisingly, they rank as the sixth biggest concern facing manufacturing businesses today.

Despite the low priority assigned to cybersecurity risks, by 2025, approximately 45% of organizations worldwide are expected to experience the impact of a supply chain cyberattack. It’s essential for manufacturers to recognize that cybersecurity risks are just as real as material shortages and workforce challenges, and should not be overlooked. 

Historically, cyberattacks primarily targeted IT systems due to their connectivity with the external world. However, the proliferation of smart manufacturing technologies has led to increased connections between OT and IT networks. Such links facilitate information exchange and real-time updates, but also create vulnerabilities.

These connections encompass various tools and technologies, such as wireless links between IT and OT systems, human machine interfaces (HMI), programmable logic controllers (PLC) responsible for controlling shop floor machines, supervisory control and data acquisition (SCADA) systems that enable real-time capture of OT data for industrial process automation, and engineering workstation applications.

While IT systems safeguard valuable data related to production processes and customer information, they lack direct control over activities that OT systems possess. If cybercriminals compromise OT networks, it could result in the complete shutdown of a manufacturing facility. Manufacturers must recognize these risks and prioritize OT cybersecurity.

It's crucial that manufacturers take proactive steps to address vulnerabilities and strengthen infrastructure security. To enhance OT cybersecurity, they should follow recommendations outlined in the National Institute of Standards of Technology (NIST) Cybersecurity Framework. These steps include:

• Identify. Conduct a comprehensive inventory of network assets, including industrial control systems and new software and devices. Assess operations through a zero-trust perspective, prioritizing critical data, assets, applications, and services (DAAS).
• Protect. Implement appropriate safeguards aligned with compliance standards and security frameworks, such as multi-factor authentication, access control, data security and network segmentation.
• Detect. Maintain constant vigilance by monitoring all endpoints within the network and relying on threat-detection services for real-time visibility and deep network inspection.
• Respond. Establish a mature incident response plan, regularly test and refine it, and collaborate with experienced OT security professionals for effective risk management.
• Recover. Prioritize rapid restoration of production operations using backup and recovery services. Conduct a thorough analysis of incidents to identify root causes and address security gaps.

To create an effective OT cybersecurity plan, manufacturers must understand their specific risks and vulnerabilities, while embracing a holistic approach that encompasses people, processes and technology. Collaboration with experienced OT cybersecurity professionals is essential to help ensure the plan's effectiveness and long-term sustainability. By acknowledging and addressing risks associated with IT and OT convergence, manufacturers can safeguard production processes, help protect their supply chains, and reap the benefits of automation and digital technology.

Nick Creath is senior global product manager, cybersecurity services at Rockwell Automation.