Tis the Season for Cyber Crime: The Importance of Cybersecurity in Industry 4.0

December 19, 2018

A scene we see all too often. A busy coffee shop full of patrons sipping their favourite hot beverage, with the glow of laptops and iPads eagerly using up the available free Wi-Fi. Little do they know, this ubiquitous activity can open the door for cyber criminals to steal identities, data and attack any networks they are connected to.

We have become accustomed to the availability of free Wi-Fi at these establishments, so much so that we often click to accept the terms of free internet, without heeding the dangers of using public networks. One such example occurred recently (described in an article by ZDNet – see link below for the full article) when a corporate laptop being used in a coffee shop was enough to allow a sophisticated cybercrime group to compromise an organization’s entire infrastructure.

The incident began when an employee of the manufacturer took their laptop to a coffee shop and used it to visit the website of one of the firm’s partners. The security researchers said the user visited the site after being directed there by a phishing email — and that the site had been compromised by FakeUpdates, a malware and social engineering campaign affecting thousands of Joomla and WordPress sites. The malware shows users pop-ups which claim their browser software needs updating. In this instance, the laptop was then infected with the Dridex banking trojan and the PowerShell Empire post-exploit toolset.

The security software being used by the manufacturer (the vender was not named) relied on devices being inside the corporate network to pick up threats. As the laptop was being used outside the network, this incident didn’t become apparent until the laptop was back in the office — by which time it was too late. The infected laptop then served as an entry point for the attackers to compromise the entire corporate network, allowing attackers to access dozens of systems that could be compromised by taking advantage of the user’s permissions. 

How many of us have simply clicked ‘ok’ when a pop-up tells us an update is available?

The coffee shop example is just one instance of how an innocent act can have big consequences, without the proper precautions and systems in place. How employees use technology is an important factor in ensuring their employer’s cybersecurity.

Critical Issues Affecting Manufacturers

An alarming percentage of small and medium-sized Canadian businesses experienced cyber incidents last year (22% of manufacturers world-wide), averaging 22 to 24 hours in downtime. The average cost of a cyber breach in Canada was $6.11 million during that same period. Overall, 48% of manufacturers have suffered from cyber-attacks, with 24% sustaining financial and other business losses.

Cyber incursions continue to grow in frequency and severity. Cyber threats have been identified as one of the most critical issues in the next 5 years, yet according to our friends at Ernst & Young, 58% of Canadian firms still say information security has little or no influence on their business strategy or plans.

Direct attacks notwithstanding, for many businesses it appears careless or uninformed employees are often the culprit for a cyber incursion.

Perhaps the most startling statistic, is 91% of respondents in the EY survey said discovery of a breach that impacted the organization would be the catalyst for increasing their cybersecurity. Waiting until after-the-fact is a complacency that industry simply cannot afford. Only 16% of Boards have sufficient information security knowledge to fully evaluate, with only 13% saying they are excellent at crisis management.

The industrial cybersecurity market is expected to grow by $10 billion through 2023. Measured by sector, manufacturing and energy are the top two critical industries targeted for cyber intrusions. More than half of manufacturers have suffered from cyber-attacks, with a quarter experiencing significant financial and business losses. It’s not just a big company problem, either. 58% of malware attack victims are categorized as small businesses.

With the acceleration of advanced manufacturing automation and robotics, machine learning/AI, blockchain and IIoT, cybersecurity is an important element to protecting your business during the fourth industrial revolution.

Best Practices

During a ‘Cybersecurity for Manufacturers’ webinar hosted by Excellence in Manufacturing Consortium (EMC) earlier this month, Scott Mossbrooks, from EMC’s Cybersecurity Team at N-Dimension recommended the following best practices for our members to check on:

• Educate Staff
• Inventory All Assets
• Implementing Access Controls
• Have a Bring Your Own Device (BYOD) Policy
• Know Where Data is Stored
• Maintain, Validate, Test Back-ups
• Employing services such as Cybersecurity Monitoring and Vulnerability Assessment Scans

Source:

https://www.emccanada.org/newsroom/tis-the-season-for-cyber-crime

https://www.zdnet.com/article/how-one-hacked-laptop-led-to-an-entire-network-being-compromised/