SLC 2019: Taking the Risk Out of Your Security Management

SLC 2019: Taking the Risk Out of Your Security Management

Nov. 12, 2019
“Companies must understand that safety and security yare no longer separate issues,” says Steve Ludwig, Safety Program Manager for Rockwell Automation

As companies are digitally transforming their operations and increasing connectivity, they are also increasing their risks, explained Steve Ludwig, Safety Program Manager for Rockwell Automation at  EHS Today’s Safety Leadership Conference.

“Does your company view security risks as safety risks?” Ludwig asked the audience during this session. “When you talk about cybersecurity there is a belief that you are talking about information, but we are also talking about risk to workers, assets, the environment and a company’s reputation.”

To make his point Ludwig gave a few examples. A German steel mill whose system was manipulated and resulted in massage damage when it was unable to shut down. And at a water treatment plant in Australia, radio commands were sent to sewage equipment causing 800,000 liters of raw sewage to spill into local parks and rivers which killed marine life.

How does this happen?  IT and OT are now connected. While being able to access information from operations is essential to secure the data needed to perform the higher analytic function that provides the benefit of Iot and IIot, there is also a higher risk. Often hackers are now getting into the safety systems in order to get into the process systems. 

Who are the people behind these cyberattacks?

At the top of the list are insiders. Sometimes it’s disgruntled workers and sometimes it’s just worker errors. Then there are cybercriminals, hacktivists, terrorists and even nation-states.

No matter who is trying to enter a company's network, there are ways that company's can protect themselves. Ludwig offered some fundamentals of cybersecurity that companies should follow.

Asset Management: know your assets and their potential risks

Authentication Authorization Accounting: know your users

Implement patch management policies and procedures

Computer and mobile endpoint protection

Disaster recovery (Backup and restore)

Raising awareness to personnel

Basic network security tasks

“Companies must understand that safety and security are no longer separate issues,” says Ludwig. “ The solution is to have a risk management approach and collaborate across all functions of the company.”

Sponsored Recommendations

Free Webinar: ISO 45001 – A Commitment to Occupational Health, Safety & Personal Wellness

May 30, 2024
Secure a safer and more productive workplace using proven Management Systems ISO 45001 and ISO 45003.

ISO 45003 – Psychological Health and Safety at Work

May 30, 2024
ISO 45003 offers a comprehensive framework to expand your existing occupational health and safety program, helping you mitigate psychosocial risks and promote overall employee...

DH Pace, national door and dock provider, reduces TRIR and claims with EHS solution

May 29, 2024
Find out how DH Pace moved from paper/email/excel to an EHS platform, changing their culture. They reduced TRIR from 4.8 to 1.46 and improved their ability to bid on and win contracts...

Case Study: Improve TRIR from 4+ to 1 with EHS Solution and Safety Training

May 29, 2024
Safety training and EHS solutions improve TRIR for Complete Mechanical Services, leading to increased business. Moving incidents, training, and other EHS procedures into the digital...

Voice your opinion!

To join the conversation, and become an exclusive member of EHS Today, create an account today!