By Bruce Geiselman
Smaller manufacturers that in the past have not placed a significant emphasis on cybersecurity might soon be required to do so by larger companies with whom they buy or sell goods.
“What they are in for a rude awakening for, if they haven’t seen it already, is real pressure coming down from enterprises and larger organizations on their supply chain,” said Brian Haugli, CEO and co-founder of SideChannel. “They’re starting to really dig in and looking at the security of all their vendors.”
Suppliers of plastic parts need to be compliant with their customers’ expectations or risk losing revenue, Haugli said.
Today’s hackers aren’t “some kid in his mom’s basement,” said Haugli, who previously provided cybersecurity services to the U.S. Department of Defense. Today, many hackers are part of sophisticated criminal enterprises with the ability to infiltrate targets through weaknesses in their supply chain vendors.
“These are well-constructed businesses,” Haugli said. “In the DOD, we used to track these folks. When they went on vacation, you could see the attacks go down. I'm not kidding. There's an ROI. These hacking operations, whether they are for economic means, military means, or social means and either sponsored by criminal groups or by countries, are set up like businesses. They have payroll; they have vacation; they have benefits; there is HR, there is accounting; there's pay; these folks have quotas that they have to hit. They're going for the things that are going to net them the most money.”
Hackers can easily find vulnerable equipment connected to the internet — equipment that hasn’t had up-to-date security patches installed or legacy software that can’t be updated. Haugli described a website that collects information about publicly available devices. The database lists millions of internet-connected devices with details about the device, and its security vulnerabilities, as well as whether the device still uses its default password. Provided with information such as a PLC firmware number or a control system model number, a bad actor can use the search engine to find vulnerable equipment meeting those criteria from across the world.
“If you have vulnerable systems facing the internet and accessible to the internet, they are being prodded and attempted to be breached, or potentially already breached,” Haugli said.
Everything connected to the internet must be patched, updated and secured, he said.
Segmenting networks, while another effective method for minimizing cyber risks, can be “notoriously difficult,” Haugli said. Proper segmentation of a network doesn’t shut down everything, but only allows the systems that are supposed to talk to each other to do so.
“You’re shutting down all of the negative activity and only allowing the activity that is authorized,” he said.
SideChannel developed its own software to encourage and simplify the segmenting of networks, he said.
“We built the Enclave product to focus on that because we saw this as an underserved area,” Haugli said. “When you start segmenting networks, it’s not intuitive, and it’s not easy. … If you can create something in a product or solution that makes it easy, there’s a higher adaptability to it.”
The product is designed to be affordable to mid-market and small businesses, he said.
SideChannel also offers managed cybersecurity services. Over the past four years, Haugli said an increasing number of startups and midsize companies in the manufacturing sector want to outsource their IT and cybersecurity responsibilities because it’s hard to attract and retain talent.
Worker safety should be another area of concern for manufacturers related to cybersecurity and protecting their OT equipment, Haugli said.
“If I had the ability to take control of a PLC or a controller in any way, anything that you can make that machine do, you can do,” Haugli said. “You can degrade it, you can make it run slow, you can stop it, you can turn off safety features, you could make it run faster and over it.”
A machine, for example, could be allowed to overheat and catch fire, which could place workers in jeopardy, he said.
“Now, there’s people who could be injured, maimed, or killed,” he said.
Contact:
SideChannel, Worcester, Mass., 508-925-0114, https://sidechannel.com/
Bruce Geiselman, senior staff reporter
