A little secret that is abundantly clear across the manufacturing industry is companies suffer cyber incidents with a greater degree of frequency, but keep them as quiet as possible so as not to create what they would see as negative backlash.
While organizations such as Bombardier, Molson Coors, Beneteau, Lactalis Group, and even the Oldsmar, Florida, water department, all suffered public incidents and they survived the publicity, there are plenty more that have simply kept everything under wraps.
That falls in line with a report in the Wall Street Journal from a few years ago saying 90 percent of known cyber incidents at public companies went undisclosed in SEC regulatory filings. Basically, unless personally identifiable information has been exposed, most electronic break-ins go unreported – leaving market analysts, investors and customers in the dark about potential risks.However, that may change because in the wake of the SolarWinds incident, there is growing momentum in Congress to get a better handle on incidents, with potential legislation introducing national breach notification requirements.
That kind of secrecy, while companies may think it is helping them, is really hurting the industry as a whole.
Lack of Transparency
“The lack of transparency and accountability ultimately hurts, and it hurts for the inability to share timely information in a timely fashion that prevents organizations from mitigating the effects of an attack that is ongoing, or for those (companies) that may not have been hit yet to be able to prevent or prepare their defense adequately,” said Jamie Brown, senior director government affairs at Tenable. “It is analogous to contact tracing program we are dealing with in terms of COVID. The speed with which you need to get the information out and to take appropriate action to address it is very important.”
Yes, there is the issue of cultural inertia barriers where there is a fear for the reputation of the company that could hurt the stock price. But ultimately there needs to be accountability and information sharing for the greater good.
Having said that, there could be a program in place to share information in a secure fashion.
“It is really important to have transparency rules and we are confident that it can be done in such a way that would allow for effective protection of information that is shared,” Brown said. “There would be anonymization and strict rules and protocols in place to secure any information that is shared by determining and developing the proper standards for what that information should look like and then having a strong understanding on how it would be disseminated and to whom. We are trying to protect those that are sharing information toward the greater good. Ultimately, it is more important to have the information shared so an attack won’t spread widely or deeply. Speed and information sharing, and situational awareness are key to that.”
Working with the Feds
As it stands right now, the concept of industry and government sharing information is weak at best.
“There is room for better standards and guidance from the federal government if they want to set up a program like this, especially if it becomes mandatory in terms of how do you communicate this and what is an appropriate response in terms of when you do suffer a cyber incident how you share that information,” Brown said. “And for those that are less mature in terms of their own incident response programs it is important for the government to provide guidance and help there, too. Not everyone has a mature information security incident response program.”
With a federal program, that begs the question of if the industry wants to work with the government?
“There historically has been hesitancy about working with the government,” Brown said. “Anytime you have a strict compliance regimen set up, your first order of business when you handle incident response is to make sure you are aligned with those requirements. Unfortunately, it becomes set in stone and eventually it becomes obsolete in terms of how flexible, nimble and agile you are in how you can respond. As government and industry work closer together, there can be the recognition for the need to have greater flexibility in order to allow companies to remain agile.”
Whether the manufacturing industry wants it or not, eventually there will be a mandate for information sharing and accountability. “That (would be) appropriate because we really do need that data to make informed decisions, and not enough is being shared right now,” Brown said.
Need to Share Information
That all falls back on there being enough anecdotal evidence to show companies are not sharing enough information.
“There needs to be more sharing of information, not just on incident response but on cyber security risk management practices,” Brown said. “There are rules under the (Securities and Exchange Commission) SEC that says you are supposed to discuss what your risk management practices are. In most cases, the actual disclosures are not granular enough. I think it would be important for publicly traded companies to attest to the fact they have undergone threat assessments, risk assessment, have identified threats, and ultimately identified and prioritized action plans for risk management frameworks to address those. We think it will be important for organizations to provide that information. Not the specific controls, you don’t want to tell folks the detailed information of your security program, but attesting to the fact you have gone through a risk management assessment, you have identified where you have gaps and what your priorities are, and you have adopted a risk management framework, ideally aligned with the NIST cybersecurity framework as an approach you have taken to address the concerns.”