Simple Yet Powerful Cybersecurity Strategies for Manufacturers

Mac Kern, a cyber analyst at TechSolve, shares some simple (but effective) cybersecurity strategies that manufacturing companies should utilize. This article originally appeared in Insight Jam, an enterprise IT community that enables human conversation on AI.

In today’s business climate, small and medium-sized manufacturers face a variety of challenges, not the least of which is cybersecurity. Due to their role in the supply chain, manufacturers are an increasingly common target for cyber-criminals—IBM’s 2024 X-Force Threat Intelligence Report named manufacturing as the industry most frequently targeted by cyber-criminals for the third year in a row. A strong cybersecurity posture isn’t cheap or easy to obtain, but when dealing with threat actors, a proactive approach will result in less stress and a significantly lower financial impact than the alternative.

Corporate information systems often contain a great deal of sensitive data—contractual information, company financials, and employee social security numbers, to name a few. It’s important to maintain the confidentiality of this information, and one way to do that is by implementing the least privilege principle. Unique user accounts should be given to all employees, with access privileges assigned in accordance with each user’s role.

Granting “least privilege” to each user account allows organizations to lower the opportunities for a bad actor to wreak havoc by gaining access to an employee’s account credentials—the more privileges assigned to one account, the more dangerous that account is in the wrong hands. This role-based approach to access control also keeps sensitive corporate, client, and personal information out of the hands of employees with no business need to access this type of data.

Mobile devices such as cell phones and tablets can present manufacturers with security issues, especially if permitted to connect to your corporate network.  Company-owned devices should be enrolled in a mobile device management program, which allows administrators to monitor access to sensitive corporate information, place restrictions on the applications that can be installed on the device, and securely wipe the device in the event of loss or theft. To keep employee-owned devices off your corporate network, consider using public key infrastructure (PKI) and 802.1x authentication. Implementing conditional access can prevent employees from accessing corporate email and other data from unmanaged, untrusted devices.

Physical security is another challenge that manufacturers face; high temperatures often lead to shop floor loading-bay doors that are kept wide open during the warmer months. Fencing and implementing gated access to the facility can be cost-prohibitive, but folding security gates are a cost-effective way to enhance physical security while allowing greater airflow.

Physical security controls can be further strengthened by implementing distinct badges for employees and visitors, as well as ensuring that employees are informed of how to report unauthorized individuals within the facility. Badge access control systems are another great way to restrict access to the facility and/or sensitive areas within. An additional benefit of this approach is that many badge systems also provide a time-stamped physical access log, which can be helpful when investigating or responding to a physical security incident.

Cybersecurity is a shared responsibility, and one of the biggest risks that manufacturers face is insider threats. A well-meaning employee who clicks a link in a phishing email can be just as dangerous as a disgruntled employee abusing their system access. Organization-wide information security and insider threat training is a great way to ensure that your workforce understands common attack vectors and how to identify potential insider threats before they cause serious damage. This type of training curriculum is available from a variety of vendors and often includes functionality such as simulated phishing campaigns to provide employees with real-world experience identifying common phishing techniques.

For organizations that lack an internal IT security team, partnering with a managed security services provider (MSSP) is a great idea. These organizations can assist with technical tasks like secure network configuration, threat monitoring, patch management, and incident response. Additionally, MSSPs may help with recurring cybersecurity tasks such as risk assessments, vulnerability scans, backup testing, and incident response exercises. These tasks, when performed regularly, enable organizations to identify threats and vulnerabilities within their environment and work toward remediating and protecting against them.

Cybersecurity insurance is also essential for manufacturers. When organizations fall victim to ransomware or a data breach, every step matters, and every second counts. In addition to protecting liability and insuring losses, cybersecurity insurance providers supply legal, financial, reporting, and forensic advice and support. They may even handle media communications during a highly publicized cyber-attack.

As the average cost of cyber-attacks grows (nearly $5 million in 2024, according to IBM), many cybersecurity insurance providers require their clients to implement fundamental information security protections to be eligible for coverage. This has the added benefit of making the organization more resilient against attack attempts in the first place.

The rapidly evolving world of cybersecurity ensures that small and medium-sized manufacturers are likely to continue facing challenges securing their data, but there are many small steps these organizations can take to significantly improve their security posture. Implementing proper access restrictions to the organization’s facility and information systems is a great starting point.

It’s also important to restrict network connectivity to only devices managed by the organization. Cybersecurity training helps ensure good cyber hygiene across the organization. Finally, external assistance can be a lifesaver when navigating technical details or responding to a critical incident.