Dec 15, 2022 by Mark Dingley
Cyberattacks can be devastating to businesses. You only need to look at the recent Optus and Medibank data breaches to see the damage it can do to a brand’s reputation–not to mention their bottom line.
In a 2021 Global Threat Intelligence Report by NTT, the manufacturing industry saw a 300% increase in worldwide cyberattacks.
Nearly one in every five ransomware attacks targets manufacturing businesses, making this industry the most targeted for the second year in a row, according to a 2022 report by ThreatLabZ.
Toyota, Bluescope Steel and dairy processor and drink manufacturer Lion, have been forced to deal with production losses after being hit by cyber attacks in the past two years.
But it’s not only large manufacturing companies that criminals are targeting.
In Brisbane last year, Langs Building Supplies was hit by a cyber attack that saw it held for $1.5 million ransom after an employee opened a simple email. It was the second attack on the company in five years.
Business Australia warns that they are seeing a ransomware attack on small businesses every 11 seconds.
The financial fallout of an attack can be crippling, but the impact on staff, customers and your brand can also not be ignored.
As Langs Building Supplies CIO Matthew Day explained, “If a cyber attack takes us out of the equation a lot of people can’t trade, and if we had been out for an extended period of time, it would have really beenbad ... you have to understand the human effect of these breaches.”
So how do you keep your business and brand safe?
Strengthen your security with these essential steps:
Adopt best cyber-security practices and comply with standards, for example NIST, IEC 72443 or NIS. These frameworks provide best practices to facilitate security by keeping all manufacturing processes in line,such asinventory-asset management and threat identification.
Review your data security and protection strategies
Most cyberattacks aim to steal data, which they can then sell on the dark web.
Implement a business strategy to ensure your data is both secure and protected. For example, make sure any data thatis collected from suppliers, customers and employees is treated appropriately, with limited access to those who view it.
It’s important to know your legal obligations. For example, in Australia, The Privacy Act 1988 (Privacy Act) protects the handling of personal information about individuals including its collection, use, storage and disclosure.
Businesses with an annual revenue of more than $3 million must comply with the Privacy Act. If you have a revenue of $3 million or less, you may still be required to comply with the Privacy Act depending on your business type and service. Most States and Territories also have their own data-protection legislation,so take time to understand your legal obligations.
Next, review your data security. How does your business protect itself from potential external threats? If you don’t have internal resources or expertise, consider engaging a data privacy and protectionagency to help.
The majority of breaches occur because of faulty internal practices. A report commissioned by Intel discovered that “internal actors were responsible for 43% of data loss, half of which is intentional, half accidental”.
For small businesses especially, human error is the leading cause of data breaches, according to an IBM report. Since small businesses do not invest as heavily in cyber-security training, employees can be easily tricked into malicious threats or sharing logins and sensitive data.
That’s why the Harvard Business Review recommends that the most significant action you can take is to create a rigorous internal guideline for cybersecurity.
The guideline should include:
Ensure your employees are aware of the risks and steps they should take to keep data and systems secure.
Any internet connectivity presents a potential target for attackers –if it is not controlled correctly. Therefore, use software that does not require an internet connection or does not automatically access the internet with permission.
For example, Matthews iDSnet is an on-premises solution, which means the software and all data is stored on internal servers, rather than all in the cloud. It sits behind your firewalls and levels of cyber protection.
If you do prefer cloud software, look for a solution that puts you in control. For example, iDSnet Cloud prompts you when connecting to the internet to check you want to give it access.
You should also update your security software, utilising firewalls, anti-virus software and anti-spyware programs where possible.
A perpetual licence is a traditional method of purchasing software, where you pay for the licence upfront and have the right to use the software indefinitely. The alternative is a subscription, where youpay for the software monthly or annually, for example.
A subscription requires the software to do regular checks to see if your licence is still valid and to perform updates. This means connecting to the internet, which can open your software to malicious threats.
With a perpetual licence, as with Matthews iDSnet, when you need software updates or technical support, you give access to the Matthews engineers to work on the software remotely.
It sounds simple, but strong passwords are critical to cybersecurity. Ensure that access to all software, wireless networks and sensitive data is guarded with unique passwords.
Enable multi-factor authentication (MFA) on important accounts wherever possible–primarily financial and email accounts. With COVID-19, many companies were using remote desktop protocol (RDP) to allow remote access to systems and often MFA was not turned on. This led to a rise in cyber threats.
Where MFA is not possible, use passphrases to protect accounts and devices. Passphrases use four or more random words as your password and are most effective when they are long, unpredictable and unique.
Do an audit of who has access to your software and systems. Not everyone in the business needs access to the software or all functionalities and databases –it only increases your risk.
Look for a software solution that allows you to manage users and permission levels. For example, with Matthews iDSnet, you can have as many users and passwords as you need. In addition, you can set up users as an operator, supervisor or maintenance, and you can control the level of data and functionalities they can access.
While they won’t prevent an attack, regular offline backups will help you recover more quickly if an attack happens. Choose a production line software that runs frequent backups of data.
Apart from taking steps to decrease the likelihood of an attack, manufacturers also need to be prepared for a time an actual attack occurs.
Ensure you have a response plan that answers these questions:
Knowing the threats is the first step to protecting your business. The Australian Cyber Security Centre (ACSC) has published a Small Business Cyber Security Guide to help small businesses understand the most common cybersecurity incidents.
By being proactive and following specific cybersecurity procedures, you can help protect your brand, productivity, reputation and customer loyalty.
If you believe you are a victim of cybercrime, immediately contact www.cyber.gov.au/acsc/report