As companies are digitally transforming their operations and increasing connectivity, they are also increasing their risks, explained Steve Ludwig, Safety Program Manager for Rockwell Automation at EHS Today’s Safety Leadership Conference.
“Does your company view security risks as safety risks?” Ludwig asked the audience during this session. “When you talk about cybersecurity there is a belief that you are talking about information, but we are also talking about risk to workers, assets, the environment and a company’s reputation.”
To make his point Ludwig gave a number of examples. There was the German steel mill whose system was manipulated and resulted in massage damage when it was unable to shut down. And at a water treatment plant in Australia, radio commands were sent to sewage equipment causing 800,000 liters of raw sewage to spill into local parks and rivers which killed marine life.
How does this happen? Whatever entity is trying to enter a company's system to cause harm must often must go through the safety system to get in the process system. And this is easier now than in the past since IT and OT are more connected. These functions must now be open in order to achieve the connectivity goals of the Internet of Things or the Industrial Internet of Things. While being able to access information from operations is essential to secure the data needed to perform the higher analytic function that provides the benefit of IoT, there is also a risk.
Who are the people behind these cyberattacks?
At the top of the list are insiders. Sometimes it’s disgruntled workers and sometimes it’s just errors. Then there are cybercriminals, hacktivists, terrorists and even nation-states.
No matter who is causing these threats there are things that companies can do starting with properly assessing the risks. Ludwig offered some ways that companies can protect themselves:
Asset Management: know your assets and their potential risks
Authentication Authorization Accounting: know your users
Implement patch management policies and procedures
Computer and mobile endpoint protection
Disaster recovery (Backup and restore)
Raising awareness to personnel
Basic network security tasks
“Companies must understand that safety and security are no longer separate issues,” says Ludwig. “ The solution is to have a risk management approach and collaborate across all functions of the company.”
