Electronics Manufacturing

Zero trust architecture (ZTA) is a security framework based on a simple concept: Don’t automatically trust any user or device, regardless of their location or network.

This strict approach to cybersecurity came about a couple of decades ago. At the time, the standard security model was based on a hardened perimeter around a corporate intranet. While there were protocols in place to ensure that only trusted users gained access to company systems, once inside a company’s online environment, a user could roam freely. This model worked well for a time, back when work was contained in a physical office building and employee devices were limited. But it proved ineffective once remote work became common. And even before the explosion of connected personal devices—i.e., tablets, smartwatches, and mobile phones—cybersecurity experts were getting worried.

One of the pioneers in solving the interconnected-device problem was John Kindervag, considered one of the world’s foremost cybersecurity experts. In 2009, he coined the term “zero trust model.” Its foundational principle comes from a Russian proverb—”trust but verify”—and it’s proven to be solid advice for many organizations. If you want to ramp up your company’s cybersecurity, be sure to adopt all three components of a zero trust model:

• Ensure all resources are accessed securely regardless of location.
• Adopt a least-privilege strategy and strictly enforce access control.
• Inspect and log all traffic.

Many companies now employ this guilty-until-proven-innocent approach across functions and departments. Most employees encounter the zero trust model whenever they’re asked to engage in multifactor authentication (MFA), which requires users to verify their identity at least twice to gain access to systems. In fact, MFA is one of the simplest ways to safeguard against cybercriminals, and even small to midsized manufacturers can easily implement this protocol.

2. Go Beyond Information Security

A cyber-physical system is a one that integrates sensing, computation, control, and networking between physical objects and infrastructure—connecting objects to the internet and to each other. An example of a cyber-physical system would be driverless cars that communicate securely with each other on smart roads.

The increased connectivity among engineered systems is bringing more risk than just information theft—it also introduces the possibility of harm to humans and the environment. Case in point: AP News reported in 2021 that someone attempted to poison a water treatment plant in Oldmar, Florida. Using a remote-access system, the hacker tried to increase the level of lye in the water supply to a dangerous level. The attempt was fortunately caught by an astute supervisor, and the city has since disabled the remote-access system.

Because of these types of risks, Gartner advises companies to take appropriate precautions, pointing out that CEOs could potentially be held personally liable for cybersecurity incidents. “In operational environments, security and risk management leaders should be more concerned about real world hazards to humans and the environment, rather than information theft,” a Gartner researcher said in 2023.

3. Create an Incident Response Plan

Even the most secure systems face risk. The question is not “if” your company will be targeted but “when.” Therefore, every company should create a thorough incident response plan: a set of written instructions with clear details on what to do in case of a data breach or other cybersecurity incident. And the time to plan is beforehand—not after an attack when every minute is critical to containing the breach. With emergency protocols and backup systems in place, you won’t waste valuable time figuring out the best response or obtaining the necessary permission to act.

Gartner suggests that an incident response plan have four phases:

• Preparation
• Detection and Analysis
• Containment
• Eradication and Recovery

Putting a response team in place and creating a plan can seem overwhelming, but it’s important to recognize the journey towards security is an evolution. As Andy Ellis, former CISO at Akamai, has pointed out, “You don’t have to do it all at once.” The focus should be on having a well-thought, actionable plan, and implementing it step by step over months, or even years if that’s what’s required.

4. Provide Employee Education and Training

Imagine pouring millions of dollars into your cybersecurity systems, only to suffer a breach when an employee unknowingly responds to a phishing email. Unfortunately, many employees still associate “phishing” with obvious scams involving foreign princes. But today’s cybercriminals are far more sophisticated, often able to adopt the personas of co-workers to ask what appear to be routine, work-related questions in order to obtain sensitive information.

While you can’t eliminate all risk of user error, proper instruction and training on cybersecurity best practices will go a long way in decreasing your company’s cybersecurity risk. And this training must be repeated on a regular basis. For example, don’t just teach employees how to identify phishing emails; send fake emails on a regular basis to test employee responses. For those who fall victim to the bait, additional training and support should be offered. Other best practices, such as requiring a second type of confirmation for sensitive requests, can also increase security.

5. Choose Your Third-Party Contractors Wisely

No matter how locked-down your own systems are, you’re only as secure as your third-party vendors and contractors—a fact exemplified by the infamous Target breach that affected 41 million consumers. Initially, no one knew how the breach occurred, but it was later discovered the hackers accessed the Target gateway server by stealing credentials from a third-party vendor.

Lesson learned? Be diligent in your screening of third-party contractors. The security of your supply chain is just as important as your internal cybersecurity.

Manufacturers in certain industries must be especially diligent. As cybersecurity company Palo Alto Networks has pointed out, “manufacturers that build national security-related products face additional types of cyber threat actors and thereby additional urgency to protect their sensitive data.” For these manufacturers, it is especially important to do business with reputable third parties that have the proper registrations and compliance programs in place. For instance, a manufacturer of defense technology should verify that its contract manufacturers are ITAR registered and have appropriate internal controls in place to secure sensitive products and all the technical data associated with such products.

Another industry that requires enhanced security is medical device manufacturing, which is why the U.S. government is attempting to increase security in this area. With the passage of The Consolidated Appropriations Act of 2023, the FDA is now required to include cybersecurity as part of its review for medical devices that contain software, such as heart defibrillators and continuous glucose monitors (CGMs).

No matter your industry, it’s not enough for your own data to be strongly encrypted. So don’t just monitor your own systems—protect your supply chain by ensuring that your vendors are doing the same.