Page 218 - Cyber Defense eMagazine RSAC Special Edition 2025

identifying threats after they have infiltrated a network, true protection is about preventing unauthorized
access in the first place, ensuring that cyber threats are stopped before they can cause harm.

Expanding Cyber Risks

Over the past decade, the manufacturing industry has rapidly integrated IoT devices, robotics, real-time
analytics, and cloud-based capabilities into more traditional industrial operations. With these connected
systems and devices now at the heart of many factories, the attack surface for cyber-threats is wider than
ever.

As IT/OT convergence accelerates, attackers can more easily exploit IT vulnerabilities to infiltrate OT
systems. Indeed, increased connectivity and data visibility within the manufacturing ecosystem – all
hastened by the recent explosion of digital connectivity – have made it a prime target for cyberattacks. In
fact, 2024 was the third consecutive year in which the sector experienced its highest number of attacks,
comprising 25% of all hacks globally.

Among the most common OT security blind spots is overreliance on outdated network access solutions.
These solutions often require only one set of credentials across numerous access points, resulting in
cases where a single set of shared credentials grant a third-party vendor unrestricted access to critical
systems. As a result of maliciousness or simple human error, this level of unintended privileged access
could lead to catastrophic consequences, far beyond financial loss or reputational damage – consider
that a cyber-attack affecting equipment in a manufacturing facility can cause serious physical
consequences for workers on the floor.

Challenges in Securing OT Environments

The legacy assets present in many OT environments typically lack built-in authentication or encryption,
making them easy targets for cyberattacks. But upgrading legacy systems can be costly and disruptive,
leading to patchwork security solutions that create substantial gaps.

The risk posed by legacy infrastructure is compounded by the fact that manufacturers frequently depend
on third-party vendors or external contractors for maintenance, software updates, troubleshooting, data
storage, and more. Traditional remote access solutions, such as VPNs and jump servers, provide no
visibility or control after the initial connection. Unless additional controls are implemented, third-party
users who connect via such tools have veritable free rein once they’re inside the network. An oft-cited
example is the 2021 Colonial Pipeline breach, a ransomware attack where hackers gained entry through
a compromised VPN password.

Many industrial organizations also struggle to maintain real-time inventories of connected assets, and
this issue will only continue to grow if cross-channel monitoring solutions are not put in place. According
to a 2024 report from Ponemon Institute and Cyolo, as many as 73% of organizations lack an authoritative
OT asset inventory. But asset inventories alone are not enough. Once an organization has full visibility
into its assets, it must proactively secure them. Knowing what’s connected is only half the battle; fortifying

218