React Less. Defend More.

SAFEGUARDING food & beverage MANUFACTURING

We assist food and beverage industry to discover, assess, secure and govern all connected assets using a risk-based and outcome-focused approach.

GET FREE CONSULTATION

Food and Beverage Industry

“The food and beverage industry has become a lucrative target for threat actors. Both are critical components of economies and, for many nations, they now represent a national security threat if compromised.”

Food and Beverage Cyber Security Challenges

Like other manufacturing sectors, the prospect of operational downtime is a situation that Food and Beverage manufacturers want to avoid at all costs. The main reason being the associated costs, with each downtime event amounting to significant sums per hour caused by product deferment or loss. Preventing downtime events, whilst ensuring data integrity of Operational Technology (OT) environments, present significant risks and challenges for OT cyber security.

In recent years, closer convergence between IT and OT has brought about a range of advantages in terms of connectivity and process efficiency across the sector, with analysts taking more information from the data generated at the machine/plant level across manufacturing, warehousing and distributor networks. However, this IT/OT convergence also increases the attack surface. 

Without robust security controls and defensible architectures, a cyber attack starting at the Enterprise IT level can propagate down into OT environments and cause potential consumer safety risks and production downtime consequences. This is because cyber attacks can interfere with OT systems that control processes on manufacturing plant floors. This carries the potential of causing safety risks due to the fact that Food and Beverage manufacturer outputs are consumable products. The safety of these products depends on a careful balance of external factors, such as recipes, treatment and storage temperatures.

Situational Awareness

Perception (What is happening):

  • An expansive and growing attack surface, arising from convergence, connectivity, geographic and organisational complexity, combined with a general lack of cyber security risk management is increasing risk exposure.
  • Increased regulatory scrutiny of critical national resource assets is putting pressure on Food and Beverage manufacturers to reassess cyber security strategies.

Comprehension (Why do I care?):

  • Consider a threat actor using a remote access Trojan to intentionally control or alter the OT systems of a food and beverage manufacturers facility. Examples of such OT systems include Distributed Control Systems (DCS) and Supervisory Control & Data Acquisition (SCADA). An array of security risks become possible with malicious actors targeting these OT systems, for example, a maliciously intended slight temperature change on the manufacturing plant floor for certain foods and beverages could expose thousands of people to food-borne illnesses. Secondly, seizing control over plant floor OT can also put workers at risk from unexpected movements or behaviour of machinery.
  • Another significant risk of cyber attacks in the sector is the loss of intellectual property. Malicious threat actors can use their access to OT networks or systems to obtain recipe information or secrets about production processes. This information can be offered for sale on the dark web, revealed openly or sold to competitors.

Food & Beverage Risk Management

In the context of an organisation with no or limited OT cyber security risk management, OTIFYD recommends a holistic approach when defining an effective OT cyber security risk management strategy/programme.

The first step in this journey is to understand risk and consequences to the organisation. At a basic level, this means identifying the most critical OT functions essential to fulfilling the organisation’s business operations, and the potential consequences of a cyber attack against them. The knowledge of an organisation’s system custodians and engineers should be leveraged to identify methods an adversary could use to compromise critical OT functions. This valuable knowledge includes technical system architecture details, procedural and ways of working insights, like logical user access, third-party service provider scope, supply chain considerations, physical security etc. Real-world cyber scenarios seen across industries should be considered, of course, not all will be applicable, but to ensure completeness and due diligence they should be considered.

The ultimate aim of this initial analysis is to identify and prioritise risks that result in high-consequence events for the organisation. It also provides a high-level snapshot of current risk exposure and whether this exposure is within or out of organisational risk appetite/tolerance. Any subsequent OT cyber security strategy/programme and risk mitigations should be aligned accordingly with this analysis to ensure tangible risk reduction that is outcome focused. This approach helps organisations justify OT cyber security improvements and the associated costs by being armed with better information and understanding of “What, Why and How?”

The second stage in the journey sees the definition and establishment of an overarching OT Cyber Security Framework (OT-CSF) that delivers formalised policies, procedures, datasets, work instructions and best practice guidance designed for OT cyber security risk management. The OT-CSF should be aligned accordingly with guidance provided within industry frameworks such as:

The scope and depth of the OT-CSF must be realistic and defined based on factors such as plausible operational business risk and regulatory compliance requirements. An overburdensome OT-CSF may deliver perfect cyber security on paper, but in reality, will likely be ignored or worked around rendering it ineffective. At a minimum, an OT-CSF should include:

  • Formal governance model (assignment of accountable, responsible, supporting, consulted roles/parties)
  • Formal end-to-end operating model (visualisation of operations through to OT asset/system support)
  • Regulatory compliance requirements (locale/country dependant, e.g. UK/EU NIS, CISA etc)
  • Asset inventorisation/management (listing of OT assets that require run and maintain support)
  • Network architecture documentation (logical and physical diagrams representing as-is architecture and includes all north-south and east-west connectivity)
  • Incident response plan (based on real-world industry scenarios that pose the most risk)
  • Workforce development (minimum training curriculum and awareness for all OT users)
  • Applicable supporting OT cyber security procedural controls (e.g., access control, management of change, portable media management, backup and recovery etc)
  • Basic performance monitoring and reporting (e.g., management reviews and continuous improvement processes)

The above represents a foundational level of controls that can be supplemented as organisational OT cyber maturity increases. Supplementary controls can be procedural or technology-based and include:

  • Internal assurance and compliance (self-assessment of OT cyber security risk management maturity)
  • External audit (independent assessment of OT cyber security risk management maturity)
  • Third-party/supplier assurance (OT cyber security requirements embedded within contracts)
  • Network monitoring and threat detection solutions (active monitoring and alerting of cyber events of interest)
  • Asset monitoring and vulnerability detection solutions (helps foresee potential security and reliability issues before they impact operations)
  • PAM – Privileged access management solutions (safeguards identities with special access or capabilities beyond regular users)  

Knowing which business risks, regulatory drivers, and real-time operational insights to focus on is only the start of the OT cyber security journey. Organisations must also be realistic about their ability to execute and sustain a strategy/programme, therefore they should ask:

  • Are budgets adequate?
  • Do the right skills exist in-house?
  • Can our suppliers and service vendors support the requirements?
  • Do governance mechanisms exist to enable business leaders to make decisions and support the cyber security strategy/programme?

The ultimate aim is to reduce an organisation’s exposure to weaknesses and vulnerabilities that could be exploited by malicious threat actors. Additionally, greater awareness of cyber risk and formalised ways of working reduce the likelihood of cyber incidents caused by workforce error or misuse of OT assets.

Of course, one size does not fit all, therefore a focused process of discovery and risk assessment is paramount to identify an effective but sustainable blend of controls that meet business needs and address the cyber risks being faced.

Call to Action

Operating a Food and Beverage manufacturing asset without an appropriate OT cyber security strategy/programme and relevant controls is high risk. To help you discover your level of risk exposure and to illustrate how we can support effective OT cyber security return on investment, get in touch for a free 30-min consultation.