How to Identify Your Company’s Cybersecurity Risks

This article originally appeared on IndustryWeek. Guest blog post by Traci Spencer, Grant Program Manager for TechSolve, Inc., the southwest regional partner of the Ohio MEP, part of the MEP National Network^TM.

This article is the first installment in a five-part series outlining best practices when it comes to "Cybersecurity for Manufacturers." These recommendations follow the National Institute of Standards and Technology (NIST) cybersecurity framework, which has become the standard for the U.S. manufacturing sector.

According to a 2018 IBM-sponsored study by the Ponemon Institute, the global average for a data breach is $3.86 million. That breaks down to almost $150 per stolen record. If you’re a small or medium-sized manufacturer, you may not think statistics like these apply to you. But out of 17 industries represented in the report, the most impacted sectors were financial, service, and wait for it — manufacturing.

Because manufacturers often put fewer resources into information security, they’re a popular target for cyber criminals. And it only takes one cyber attack to devastate a smaller manufacturer's entire operational system. Networked machinery, suppliers, distributors, or even customers could all be hacked via one computer/device in a manufacturing facility.

Other risks include:

• Loss of information critical to running your business
• Negative impact on customer confidence
• Regulatory fines and resulting legal fees
• Decreased or stopped productivity.

Fortunately, you can learn to protect your operations with the help of the National Institute of Standards and Technology (NIST), which has developed a five-step framework for cybersecurity that can be implemented by a business of any size. Available online, the NIST Cybersecurity Framework can be further explained by your local representative of the MEP National Network, the go-to experts for advancing U.S. manufacturing. You can also view the Manufacturers Guide to Cybersecurity (add link once we know document’s location) which provides manufacturers with basic practices and tools needed to develop a cybersecurity program.

Ready to take your first step toward data security? The process begins by identifying your risks. 

Control Who Has Access to Your Information

Make a list of employees with computer access and include all of your business accounts, the type of access (physical or passwords), and physically secure all laptops and mobile devices when not in use. Have your employees use a privacy screen or position the computer’s screen so people walking by cannot see the information on display, and have them set the screen lock to activate when the computer is not in use.

Do not allow physical access to computers or systems by unauthorized personnel, such as:  

• Cleaning crews or maintenance personnel
• Unsupervised computer or network repair personnel working on systems or devices
• Unrecognized individuals that walk into your office or shop floor without being questioned by an employee

It only takes seconds for a criminal to access an unlocked machine. Don’t make it easy for them to steal your sensitive information. 

Conduct Background & Security Checks for All Employees

Background checks are essential to identifying your cybersecurity risks. Full nationwide searches should be conducted for all prospective employees or others who will have access to your computers and company’s systems and equipment.

These checks should include:

• Criminal background checks
• Sexual offender checks
• Credit checks, if possible (some U.S. states limit the use of credit checks)
• References to verify dates worked for previous employers
• Education and degree verification

You may also consider conducting a background check on yourself, which can quickly alert you if you have unknowingly become the victim of identity theft.

Require Individual User Accounts for Each Employee

If you experience data loss or unauthorized data manipulation, it can be difficult to investigate without individual accounts for each user. Set up a separate account for each employee and contractor that needs access. Require them to use strong, unique passwords for each account.

Limit the number of employees who have administrative access, especially if it isn’t required for them to perform their daily job duties. Consider guest accounts with only Internet access for visitors or customers at your facility.

Create Cybersecurity Policies & Procedures

While creating your first cybersecurity policy may seem like a daunting task, there are plenty of easy-to-follow tips from the MEP National Network that can help you get started. You may also want to consult with a legal professional familiar with cyber law to review your policies to make sure you’re complying with local laws and regulations.

Your new cybersecurity policy should include:

• Your expectations from your employees for protecting company information
• Essential resources that need to be protected and how you expect your employees to protect that information
• A signed agreement from each employee to confirm they’ve read the policy and understand it.

Keep the signed agreement in each employee’s HR file. Review the policy at least once a year and make updates when you make any changes to your company’s technology. You can then use your cybersecurity policy to train your new employees on their information security responsibilities and set acceptable practices for all your business operations.

Now that you’ve learned how to identify your risks and assess your resources, it’s time to think about protecting them. In part two of our five-part “Cybersecurity for Manufacturers” series from the MEP National Network, we walk through the key steps to protect your valuable data and information from cyber threats.