Protiviti Inc.
09/24/2024 | News release | Distributed by Public on 09/24/2024 12:32
Enhancing Cyber Resilience Strategies in Global Manufacturing with the FAIR Methodology
Breadcrumb
Enhancing Cyber Resilience Strategies in Global Manufacturing with the FAIR Methodology
Client Snapshot
Profile
This client is a global manufacturer of diverse industrial and automotive parts.
Client Situation
A holistic security governance and compliance program, inclusive of data privacy, was needed to define and advance the client's cybersecurity posture. Uncertainty as to which threats posed the most risk and which assets to prioritize made this a challenge, which was even more pronounced in the Operational Technology (OT) space.
Work Performed
To begin prioritizing cybersecurity gaps in the OT environment, Protiviti conducted 30+ triage risk and 20 total quantitative assessments on business-critical assets using insights from on-the-ground manufacturing site visits. Protiviti established risk scenarios, led a quantitative risk assessment pilot, and performed five future state control implementation analyses to prioritize allocation of limited cybersecurity funding.
Outcome/Benefits
With a FAIR program in place, the client now has a comprehensive understanding of its risk landscape, including critical assets and dependencies, a thorough list of potential cyber threats, and improved understanding of risk tolerance, which support using cybersecurity budget to address the most critical risk areas first. We also helped prioritize which product lines and components at each location would reduce risk today, and which could be deferred to effectively distribute upfront investment.
With the evolution of publicly reported ransomware events and the significant losses incurred by manufacturing organizations that are unable to operate for days, or even weeks at a time, many manufacturing organizations have renewed interest in how resilient their continuing operations are in the face of cybersecurity threats. In the last year, organizations have faced several hundred million dollar reported losses and resulting supply chain issues have received growing publicity from single ransomware events. This provides a clear business case for investing in cybersecurity controls, but in operational technology (OT) environments it can be difficult to understand where funding would be most impactful.
This global organization, which manufactures highly specialized technologies for the automotive industry, recognized it lacked a clear understanding of its most critical enterprise-level risks across multiple areas, including which threats posed the most risk to the company's OT environments. As a result, this lack of visibility and disparate OT security practices caused challenges for the organization's decision-making and funding decisions. A Factor Analysis of Information Risk (FAIR) quantification program was the best solution to effectively prioritize potential cybersecurity investments, but the company had limited risk quantification expertise. Protiviti brought a holistic approach to the organization's cybersecurity compliance challenges and developed a FAIR program to complement a broader approach to address product security, data privacy, and manufacturing technology risk across a single cybersecurity roadmap.
Starting with a FAIR analysis
The client initially selected Protiviti to perform a FAIR analysis at two of its international manufacturing locations. This involved:
- Establishing a high-level risk register to quickly assess risks across these locations, establishing a common language and process for OT risk management.
- Developing a comparative analysis to effectively triage risk scenarios based on level of criticality to identify top risk scenarios for additional analysis.
- Identifying and assessing the most critical organizational risks and identifying the business impact in financial terms.
- Developing risk clarity reporting to identify and optimize risk treatment opportunities.
Ten cyber risk scenarios were quantified using the FAIR methodology to model the potential annualized loss exposure (ALE) should a scenario materialize. Additionally, the team identified 18 actionable observations, each prioritized quantitatively, to strengthen OT security controls, including:
- Site governance: Core IT support processes and activities were handled in an ad-hoc and unstructured manner resulting in a lack of clearly defined roles and responsibilities for core security and privacy functions including asset and configuration management, patch and vulnerability management, and disaster recovery.
- Production device inventories: Asset and component inventories were not consistently maintained and were updated on an inconsistent or ad hoc basis.
- Production device configuration management: Production devices were not always consistently configured and maintained using industry-leading practices. For example, the team could externally access the Internet via production line devices.
- Production device patch management and hardening: There was no formalized, comprehensive patch and vulnerability management program supporting manufacturing site technology. Devices were patched manually and often fell out of security compliance.
- Access to production systems: A lack of secure user accounts and access management within both manufacturing sites, including a lack of user access reviews, consistent provisioning and deprovisioning processes, and the sharing of accounts between users.
These observations were analyzed in aggregate but were also looked at specific to individual product lines or locations. Rather than target a single risk with an organization-wide program, this allowed the client to better invest cybersecurity resources in the areas where they would make the most difference.
Ten cyber risks were analyzed using FAIR to model the potential annualized loss exposure of realistic OT cyber threats.
Analyzing risk scenarios
Combining site-level data gathered through onsite visits with the quantitative analysis using the FAIR methodology, the team identified and scoped risk scenarios that reflected the client's risk landscape and controls. The most likely risk scenarios for this client included:
- Ransomware: Ransomware accounted for four of the top five overall scenarios. Factors impacting the overall ranking of these scenarios include the historical frequency of similar events within the client's environment, vulnerability of the systems supporting each product line (i.e., OS or software version), revenue derived from each product line, headcount supporting each product line and average wage of those supporting the line, response efforts required to remediate the incident, and potential chargebacks or canceled purchase orders with regards to lack of availability.
- Denial-of-service: Factors impacting the overall ranking of these scenarios included the historical frequency of similar events within the company's environment, production line network dependency, and the current network architecture of each manufacturing site in scope.
- Environmental outage: Environmental scenarios are often "long tail" risks, as they are extremely unlikely to materialize, but the potential magnitude could be substantial.
- Forms of loss, including primary productivity, secondary fines and judgments, primary response, and primary replacement values.
For each set of risk scenarios, site level threat and asset data were analyzed to quantify and prioritize risks and direct cyber controls investments to the most critical risk areas.
Ready to tackle risks head-on
Due to our comprehensive risk analysis, the client repositioned its risk management strategy globally. Throughout the scope of this three-month project, we:
- Established comprehensive risk landscape clarity for the client, including a detailed asset library, thorough list of potential threats, and related outcomes.
- Effectively used the results of risk assessments to support the client's drive to establish an overall risk management program.
- Evaluated recommendations for operational technology security improvements and prioritized each based on the expected future state risk reduction.
- Operationalized the FAIR program for the client so that the program is now self-sufficient and repeatable.
Impact by the Numbers:
30+
Triage risk assessments completed
20
Quantitative risk assessments completed
5
Future state control
implementation analysis completed
Industries