“People are happy with what they have, but they don’t know how much trouble they are in.”
— Andrew Ginter, vice president industrial security at Waterfall Security Solutions
By Gregory Hale
There are rare people out in the industry that truly have an understanding of what is coming before anyone else and has an original idea about what the future will or could look like – a true visionary.
To that end, there is a movie that came out in 2011 entitled “Margin Call,” where a large Wall Street investment bank is just finding out about possible huge financial losses in the initial stages of the financial crisis of 2007-2008.
The chief executive of the firm tells his executive board what his job is all about: “Do you care to know why I am in this chair with you all? Why I earn the big bucks? I am here for one reason and one reason alone. I am here to guess what the music might do a week, a month, a year from now. … I am afraid I don’t hear a thing. Just silence.”
With an impending financial disaster confronting them and executives at a loss for what to do, that scene can sum up the mindset of a vast majority of manufacturing industry companies when it comes to cybersecurity. They often seem content with what they have and don’t want to see what is ahead.
Increased Connectivity
Think about it. The industry is on the precipice of embracing an increasing level of digitization which means increased connectivity where more devices are talking to users and each other. That level of connectivity has great benefits to bring manufacturers to greater efficiency and productivity – not to mention profitability.
Add on top of that there is an increasing amount of sophistication among attackers that are targeting more specific attacks. Colonial Pipeline; JBS Foods; Iowa agricultural business, New Cooperative; CNA Financial; Bridgestone, and Samsung just to name a few that suffered ransomware attacks. SolarWinds, Kaseya, Log4J, and Okta fell to supply chain attacks.
Then add on top of that, the possibility of more Russian attackers focusing on damaging United States critical infrastructure so they could divert attention from Russia’s attack on Ukraine.
Those are attack scenarios that would keep any executive or security professional up at night not hearing a thing, just silence. When and where will the next attack come? Negative or dire? Yes. Sounds like it is time to get rolling.
That is where having security vision comes into play. Not just having a plan to handle the current atmosphere, but understanding where things are going today, but also in a week, a month, or a year from now.
The Vision Thing
The issue with creating a vision, is there has to be an understanding of what the company is all about, where it is headed and how it is going to get there. With that understanding – and complete organizational buy in – cybersecurity needs to be the backbone holding it all together. No one should be content with what protection they have today, because it will continually need to evolve to stay one step ahead and resilient to any kind of attack scenarios that will be coming in their direction.
Companies had better start now because it won’t be too long before the vision is forced as President Joe Biden signed the “Cyber Incident Reporting for Critical Infrastructure Act” into law, which will require critical infrastructure owners and operators to report “substantial” cyber incidents to the U.S. government.
The law is part of U.S. government’s effort to strengthen cybersecurity and protect critical infrastructure.
While it will take up to two years to draft rules for the reporting requirements, businesses in the U.S. need to be aware of what is behind the law, and their potential reporting obligations.
The law mandates critical infrastructure operators to alert Homeland Security Department’s Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours of a breach — or 24 hours if the operator makes a ransomware payment in response to hacker demands.
“Critical infrastructure sectors” include financial services, food and agriculture, healthcare and public health, energy and communications. If companies just think this is lip service from the government and they can just ignore it. Think again as the new law gives CISA powers to subpoena businesses that do not report security incidents or ransomware payments.
Now is the time to find out what you have, what it looks like now compared to what it should look like and who and what it is talking to.
Now is the time to find the vision.