Open search

    The era of closed systems is over – once the doors to AI and data analytics are opened, cyber security must be solid

    For industrial companies, cybersecurity has traditionally meant forming closed systems that are completely isolated. The problem with this approach is that while it prevents information security threats, it also shuts out opportunities created by new technologies. Taking advantage of these benefits requires interconnected systems.

    The more digitalization pervades traditional industries, the more obsolete simple hardening of the system perimeter is rendered. The best results are achieved by balancing all elements of cybersecurity: people, processes and technology. 

    Why cybersecurity is a hot topic in industry

    Cybersecurity has risen from the margins and taken centre stage among leadership team discussions for several reasons.

    New technologies offer unlimited possibilities for industrial business. Innovations allow industrial companies to offer new services over digital interfaces to complement traditional plant and machinery deliveries. Some services mash up and present information collected from the installed base in more usable and actionable ways, while others utilize cloud computing, artificial intelligence, data analytics and machine learning. There are also services that enable remote monitoring and management of increasingly autonomous plants and machinery, even with mobile devices. The prerequisite for grasping such opportunities is solid cybersecurity.

    With the progress of technology, the information security requirements of end customers are becoming increasingly complex. The role of standards is also becoming more prominent, and, for example, compliance with standards IEC 62443 or ISO 27001 is an increasingly frequent topic in customer discussions.

    However, cybersecurity is not always about managing threats. It can also serve as a business opportunity; industrial companies can address the cybersecurity concerns of their clients with paid cybersecurity services. Such services can ensure the security of all deliveries throughout the entire life cycle of the systems. 

    Humans are the weakest link

    In cybersecurity, humans are always the weakest link; according to studies, up to 95% of data breaches are related to human factors. 

    With this in mind, the discussion on cybersecurity should start with people. Even closed environments are not immune to human errors. The problem may begin with a simple plugging in of a USB memory device, weak passwords, or even an employee forgetting their work computer on the train. 

    The best approach is to train the entire staff. The least an organisation can do is to make sure that key personnel are adequately trained in relevant cybersecurity skills. In addition to various forms of training, a good way to improve the skills of a leadership team is through a tailored cybersecurity management training programme. A simulated cybersecurity incident is the best way of finding the exact status and capabilities of a company in a crisis situation. Overall, staff training is the most cost-effective way to improve organisational information security. 

    The smoother the process, the better its effectiveness

    Digital security management requires a systematic approach. One element of successfully managed cybersecurity is that all security-related processes are in order and that all employees know how to use them. For example, a company may adopt a protocol where HR management never sends links to company tools in group e-mails, but any tool-related communications are handled through the company intranet. If HR management sends an e-mail with a link to an external website for surveys requiring employees to log in, alarm bells should be ringing. It is important that HR management adheres to secure protocols and communicates only through the intranet in order to avoid encouraging incorrect information security behaviour among staff. 

    In other words, it is simply not enough to address cybersecurity at a strategy level; cybersecurity must be implemented on an operational level. Despite the fact that cybersecurity mainly revolves around proactiveness and preparedness, reacting to an acute cybersecurity threat needs to be as instant as reacting to a fire alarm. Automating the processes helps reduce reaction times. For example, artificial intelligence can be used to identify exceptions and address potential breaches in order to avoid damages.

    Lean processes and preparedness also relate to the development of software-based systems. Companies pioneering in information security integrate cybersecurity into the DevOps culture of software development. This approach is not simply an annual penetration test, but a systematic way of working where information security is connected to the DevOps operating model, where software development, testing, release and maintenance are handled quickly and regularly through automatic tools. Well-polished working methods and tools help keep cybersecurity-related workload at a reasonable level. 

    Technology hardened to the core

    Today, the most secure technology is hardened all the way to the core, not only on the outside. The onion model of information security, also known as the defense in depth model, consists of redundant layers designed to protect a system against different threats. If any of the layers is breached, the next one will step in. 

    The best way to ensure information security for technological applications is during the development and implementation stages. Starting the process at an earlier stage makes it possible to go for a secure product development method. Secure development methods consider the security threats and risks that the system may potentially be exposed to. Secure development methods include, for example, systematic threat modeling,  multi-layered information security testing and managing the vulnerabilities of the selected 3rd party technologies. The development method also implements technical features that help mitigate risks related to the technologies. Such features may include user identification or continuous information security monitoring. Thanks to the risk-based prioritization, this approach also reduces unnecessary work, freeing time and financial resources from non-essential information security work.

     

    Roadmap to industrial cybersecurity:

    1. Start now.
    2. Train your staff.
    3. Make sure the correct processes exist, work properly and are developed according to lean principles.
    4. When implementing new technologies, start with secure development methods. 

    Author

    2030_048_Intopalo

    Henry Haverinen

    LinkedIn