The manufacturing sector faces an increasingly daunting cyber threat landscape that puts production operations, intellectual property, and entire supply chains at risk. In a white paper released this month, the World Economic Forum (WEF) has issued a call to action for industrial companies to foster a pervasive culture of cyber resilience.
Titled "Building a Culture of Cyber Resilience in Manufacturing," the report provides a comprehensive framework for instilling cybersecurity priorities and readiness across manufacturing enterprises. It advocates moving beyond traditional cybersecurity compliance checklists toward holistic resilience.
"Simply checking boxes is no longer sufficient to withstand escalating cyber attacks from criminals, nation-states, and insiders," the paper states. "Manufacturers must make cyber resilience a fully institutionalized part of their organizational identity."
The WEF's recommendations span three core dimensions of cyber resilience in manufacturing:
Governance and risk management
Technology enablers
Workforce development and awareness
The paper highlights several real-world examples of manufacturing cyber incidents that illustrate escalating risks, from costly ransomware attacks to intellectual property theft by nation-state actors. It warns that by 2030, damages from cyberattacks on manufacturing could total $1.5 trillion annually.
"We can no longer accept divergent cultures in IT and OT. The risk is too great, and key business partnerships are required," said Amy Bogac, former CISO at The Clorox Company. "If you are a CFO, COO, or supply chain leader, please engage with your security partner like your (professional) life depends on it."
Bogac added: "I wholeheartedly agree that manufacturing companies must engage with these three guiding principles:
To overcome this existential threat, the WEF advocates cyber resilience as a strategic imperative requiring C-suite leadership, cross-organizational cultural change management, and a mindset of continuous adaptation to evolving cyber threats.
"Safety is always the number one priority in manufacturing organizations," said Tammy Klotz, CISO at Trinseo. "Security practitioners who embed security into their company's safety program will be most successful. All workers should go home at the end of the day as safe and secure as they arrived!"
"Protecting manufacturing operations requires a shared responsibility model, which includes local plant leadership, manufacturing engineering and operations, and information technology and security teams. Active executive sponsorship from the Chief Operating Officer, Chief Information/Digital Officer, and Chief Information Security Officer sets the tone from the top and drives everyone to the same common goals."
While implementing the WEF's recommendations requires significant investment, the paper argues the potential impacts of a single major cyber incident could prove far more devastating to manufacturers' bottom lines, competitiveness, and reputations.
"In the realm of building control systems, each structure can harbor anywhere from four to eight distinct systems. These systems are managed by a single service provider, who, in turn, may employ four to five technicians with round-the-clock access," said Fred Gordy, National Practice Lead, Building Cybersecurity, at Michael Baker International. "Unfortunately, most service providers rely on a single username and password across all systems, granting access to both current and former employees. Remarkably, the majority of building owners lack service agreements that govern provider access. Consequently, in an average building with six systems, an alarming 24 to 100 or more individuals can have unrestricted, uncontrolled access to critical infrastructure. Addressing this significant gap is imperative."Some snippets from the white paper:
The SecureWorld Manufacturing & Retail virtual conference on August 28 will tackle all things cybersecurity related to the two sectors. Here are speakers and topics already locked in on the agenda:
Col. Leighton had this to say about the white paper:
"The WEF is recognizing what many of us in the industry have long known: compliance checklists provide a false sense of security to anyone who uses them, he said. "Cyber threats have morphed. Cybercriminals and nation-states engaged in nefarious cyber activities are exceptionally creative. These bad actors now hide their activities within the very logs companies use to track the health of their IT networks. The manufacturing sector has to get smarter at spotting anomalies both in their logs and in their IT networks."
"VOLT TYPHOON is a prime example of how 'living off the land' techniques can be used to hide cyberattacks in plain sight," Col. Leighton added. "In this case, it's the Chinese doing the 'bad acting,' but the principle remains the same: disguise your activity as part of the legitimate traffic on a given network. It's very difficult for cybersecurity professionals to detect this kind of activity, even if they are looking for it."
As manufacturing digitization and connectivity expand attack surfaces, the World Economic Forum has issued a clarion call. Building enterprise-wide cultures fully imbued with cyber resilience disciplines may be manufacturers' best path toward surviving the gathering cyber storm.
"The huge advantage attackers have over defenders has widened even more with more sophisticated attacks and AI, particularly regarding OT, as we see that as a desired target amid increasing convergence and modernization," Al Lindseth said. "Critical infrastructure and industrial operations really need to take heed and start applying better and more effective top-down risk/resiliency approaches versus following checkbox regulatory driven mandates and relatively simple assessments and mitigation actions."
The report is filled with suggestions, based on survey data, for improving cybersecurity for organizations with manufacturing at their core; including case studies from Unilever, KDD, Siemens, Rockwell Automation, Schneider Electric, Flex, Engro Corporation, and Volkswagen Group.
The WEF white paper concludes:
"Recognizing the complexity and scale of integrating cyber resilience across the manufacturing ecosystem, this playbook offers guidance
to understand the impact of cyber risk on manufacturing and work together to drive a successful cyber resilience culture in manufacturing."
More from Col. Leighton: "It's becoming more and more evident that cybersecurity professionals need to be trained in cyber intelligence trade craft. Cybersecurity training programs need to teach people how the 'other side' thinks and acts. In essence, there's a need for cultural awareness training so we can better anticipate what bad actors might be up to."
"Corporate boards need to include members who are well-versed in cyber intelligence; and those board members who don't understand the cyber threat need to make an effort to understand the dimensions of the cyber threats out there, or they need to make way for those who do," Leighton continued. "Generally speaking, the WEF report is a step in the right direction. If manufacturers adopt its recommendations, they won't be immune from cyberattacks, but they will be far better prepared to deal with them."