Cybersecurity Trends in the Manufacturing & Distribution Industries
Published on by Bryan Gayhart in Manufacturing, SOC Reports, Wholesale / Distribution
Throughout 2024, the world witnessed a surge in high-profile cyberattacks, including notable incidents such as the CrowdStrike disruption impacting Delta Airlines, and the Change Healthcare breach affecting an estimated 100 million individuals. While the rise of Artificial Intelligence (AI) presents significant opportunities for businesses, it also introduces new complexities to the threat landscape. This underscores the critical need for organizations to safeguard their most valuable data and applications – and that requires investing in robust cybersecurity measures.
The manufacturing and distribution sectors are particularly susceptible to these evolving threats, given the increasing reliance on virtual environments and frequent engagement with third-party vendors who may have access to or process company data. We anticipate the following key cybersecurity trends to emerge over the next 12 months:
1. SEC Cybersecurity Disclosure Rule
Trend: The SEC’s goal here was to ensure that disclosures were consistent across entities and provided in a timely manner for investors.
Solution: Beginning in 2024, publicly traded companies were required to disclose material cyber security incidents within four days of identifying the incident. As part of annual disclosures, publicly traded companies were required to disclose their process for cybersecurity risk management, strategy, and governance.
Example: As publicly traded companies strengthen their cybersecurity posture through increased investments in programs and controls, heightened security expectations will cascade through the supply chain. This will necessitate enhanced security requirements for vendors to maintain their business relationships.
2. Securing Internet of Things (IoT) devices
Trend: As warehouses become more automated and leverage technology, each application and endpoint becomes a potential surface to attack.
Solution: Deploying endpoint security on all company devices and network segmentation to secure and protect critical assets.
Example: Adopt secure password practices that require a strong password and change the default password once the endpoint has been added to the network. Monitor devices for issues and patch and update firmware when available.
3. Zero-trust architecture
Trend: Security has traditionally been a perimeter-based approach, but as companies move towards cloud-based infrastructures, a zero-trust model is becoming necessary.
Solution: Continuous authentication and validation of users, devices, and applications across the network.
Example: Implementation of role-based access systems for critical infrastructure and applications.
4. Ransomware defense and recovery planning
Trend: Ransomware attacks are becoming more sophisticated and increasingly are targeting operational technology.
Solution: Regular data backups and incident response plan development and testing.
Example: An air-gapped backup system that cannot be accessed remotely.
5. Supply chain cybersecurity
Trend: Remember the Target breach from 2013? Bad actors are increasingly motivated financially – but the bigger picture is breaching one company to get access to potentially a much larger organization.
Solution: Vetting third-party vendors, monitoring third-party access, and requiring SOC Reports from third parties who access or process sensitive data.
Example: Mandating cybersecurity certifications for suppliers to ensure minimum security standards. SOC 2, SOC 1, SOC for Supply Chain, ISO 27001, NIST, and PCI are some of the more common attestation reports.
6. Compliance with cybersecurity regulations
Trend: Regulating bodies worldwide are starting to enforce cybersecurity requirements.
Solution: As mentioned above, adopting a security framework that aligns with your company’s mission provides a maturity component to your control environment.
Example: Proactively establishing policies and procedures based on a chosen security framework establishes credibility with customers and provides a level of comfort to shareholders and investors. It may even be a contract requirement if serving customers in the healthcare, defense, or aerospace sectors.
7. Workforce training and awareness
Trend: Bad actors continue to target individuals as human error remains a significant cause of cyber incidents. Hopefully, we’ve all seen the gift card scam enough by now to know it’s fraudulent, but unfortunately, since it’s still out there it’s still successful.
Solution: Ongoing cybersecurity training and awareness programs for employees.
Example: Phishing simulation exercises and mandatory cybersecurity certifications for staff.
Staying vigilant is key
In today’s dynamic cybersecurity landscape, manufacturers and distributors face an evolving threat environment. Proactive defense is paramount. We would appreciate the opportunity to discuss your environment and gain a deeper understanding of your business operations, existing cybersecurity program, and any current or anticipated regulatory compliance needs.
Contact us now to set up a free consultation with one of our top cybersecurity pros – as always, we’re here to help.
