As companies are digitally transforming their operations and increasing connectivity, they are also increasing their risks, explained Steve Ludwig, Safety Program Manager for Rockwell Automation at EHS Today’s Safety Leadership Conference.
“Does your company view security risks as safety risks?” Ludwig asked the audience during this session. “When you talk about cybersecurity there is a belief that you are talking about information, but we are also talking about risk to workers, assets, the environment and a company’s reputation.”
To make his point Ludwig gave a few examples. A German steel mill whose system was manipulated and resulted in massage damage when it was unable to shut down. And at a water treatment plant in Australia, radio commands were sent to sewage equipment causing 800,000 liters of raw sewage to spill into local parks and rivers which killed marine life.
How does this happen? IT and OT are now connected. While being able to access information from operations is essential to secure the data needed to perform the higher analytic function that provides the benefit of Iot and IIot, there is also a higher risk. Often hackers are now getting into the safety systems in order to get into the process systems.
Who are the people behind these cyberattacks?
At the top of the list are insiders. Sometimes it’s disgruntled workers and sometimes it’s just worker errors. Then there are cybercriminals, hacktivists, terrorists and even nation-states.
No matter who is trying to enter a company's network, there are ways that company's can protect themselves. Ludwig offered some fundamentals of cybersecurity that companies should follow.
Asset Management: know your assets and their potential risks
Authentication Authorization Accounting: know your users
Implement patch management policies and procedures
Computer and mobile endpoint protection
Disaster recovery (Backup and restore)
Raising awareness to personnel
Basic network security tasks
“Companies must understand that safety and security are no longer separate issues,” says Ludwig. “ The solution is to have a risk management approach and collaborate across all functions of the company.”
