Masaaki Komori
Masaaki Komori We0 Bq Qew Bo Unsplash

Manufacturers Work Too Hard to Unknowingly Hand Over the Keys

April 13, 2021
In a fully connected world, paying close attention to access is a crucial component to sustainable success.

For many companies today producing the end product is often a team effort with a mix of integrated suppliers, outside contractors and strategic partners all playing instrumental roles. So much so that granting these third parties with access to everything needed to keep production environments running with smooth efficiency has become a norm for many manufacturers.

In many instances the multifaceted process is a perfect example of seamless collaboration. However, as manufacturers grant greater levels of access – including privileged access to third parties – it quickly intensives the risks.

"As supply chains grow, it doesn't take long for the scale of the problem to become massive. In many instances there are exponential ratios of third parties to employees," David Pignolet, CEO of Fall River, Mass-based SecZetta tells IndustryWeek. "Unfortunately, when granting third parties with access, they often do so with a fraction of the checks and balances on the individuals receiving access."

The potential risk? Exposing confidential information, unauthorized disclosures, jeopardizing physical assets, along with high costs and tarnished brand reputation come with these incidents.

"Companies need to embrace a concept that always asks whether people or things are worthy of the access granted. This requires a well-defined system to focus on their worthiness," he says. "Manufacturers need a mindset of zero trust unless it's consistently proven that they should be trusted. Instead of tackling it from an account or access first perspective, you really need to tackle the problem from a human first perspective and use that context to drive appropriate access methodologies."

The same is true when diving into operational technology (OT). Although there is often talk of air gapping OT devices, reality rarely aligns with the theory, explains Pignolet. "From a security perspective granting permission is not much different from what a human is granted,” he says. “However, monitoring access and avoiding the temptation to tie it together with the IT environment in a meaningful way is crucial because during a breach in that OT network, a bad actor could take over operator rights."

According to Pignolet, manufacturers need to better track who the third-party individuals are they are granted access, mostly because they lack a direct contractual relationship with those individuals. This is where zero trust makes sense including timely termination of accounts for third parties.

“Often times, what organizations do is they do a cleanup effort, which is usually an inactivity report. Unfortunately, it doesn't fix the problem because when account has continued use the third-party individual doesn't show up on the report,” he says. “If a manufacturer depends on access certifications, which might be by annually, at best, sometimes annually, is really important to apply those practices to mitigate risks.”

The other consideration is privileged access, especially when it comes to RPAs. Far too often organizations lack awareness around how many third parties, bots and RPAs have access. “When you actually think about scale, it is terrifying, especially when the goal is to get the access needed whether it’s a device or a person that needed access,” says Pignolet.

Popular Sponsored Recommendations

7 Crucial Steps to Improve Your OT Security

Oct. 23, 2023
Enhance OT security in manufacturing and production. Uncover the crucial steps to safeguard your operational technology. Protect against evolving threats and bridge the IT-OT ...

Beware Extreme Software

Sept. 24, 2023
As a manufacturer, you understand the importance of staying ahead of the curve and being proactive in your approach to technology. With the rapid pace of change in the industry...

Why DataOps may be the key to unlocking the full potential of digital transformation

Nov. 3, 2023
Read the 2023 market survey conducted by IndustryWeek

Powering Up Productivity: The Transformative Power of AP Automation in Manufacturing

Oct. 25, 2023
Discover how AP Automation is revolutionizing the manufacturing industry, driving efficiency, cost savings, and security. In today's world, automation is the key to staying competitive...

Voice your opinion!

To join the conversation, and become an exclusive member of IndustryWeek, create an account today!