Driving Cybersecurity for Pharmaceutical Manufacturers

Millions of people depend on life-saving pharmaceutical drugs and over-the-counter every day. With people’s health on the line, global pharmaceutical companies manufacturing these medicines must have failsafe and resilient operations. That means they must be protected by robust IT and manufacturing cybersecurity practices that can keep up with increased digitization and advancing technologies on the factory floor. Our work with a major pharmaceutical industry client has helped reduce cybersecurity incidents and implement leading-edge cybersecurity solutions at plants around the world.

Driven by regulatory compliance factors and enticed by the ability to gather valuable data from the factory floor, many manufacturers are connecting previously air-gapped systems to online networks. As they do so, they need to ensure that their equipment remains secure from the cyber threats brought by connectivity. When the NOTPETYA cyber attack caused global disruptions and huge losses for manufacturers in several industries in 2017, many companies took a closer look at their manufacturing cybersecurity practices.

That’s when our client approached us. They suspected malware existed in their networks at different plants, but couldn’t identify the entry and egress points that were enabling the malware in their environment. Plants continued to operate, but the presence of malware and other cyber issues represented an existential threat to equipment that controlled such essential variables as the speed of assembly lines, the temperature of vats in the production area, and the cataloging of produced commodities. To complicate matters, the company’s locally managed global plants' traditional performance indicators did not always include cybersecurity metrics. This made it hard to implement strong and consistent OT cybersecurity practices across the enterprise. The client, as do many manufacturing firms, also uses legacy computers and operating systems that lack the latest cybersecurity defenses.

The company’s global security operations team needed a partner to help educate local plants on the importance of cybersecurity and to implement a set of critical cybersecurity functionalities such as better network segmentation, new security tool installation, and enablement of data logging for visibility.

To ensure lasting, effective cybersecurity operations, we brought in a team that included developers, cybersecurity experts, data scientists, manufacturing industry experts, transformation strategists, and experts in governance and culture. Together, they catalogued and highlighted the threats and mitigations in the manufacturing environment at large.

To identify available data sources, we evaluated the plants’ network behaviors, especially those taking place on critical systems. To monitor risky behaviors and identify potential threats on the network, we designed custom analytics and alerts. We also created incident response playbooks and an alerts system for the global operations center.

To reduce risky behaviors at individual plants, we helped develop an enterprise-wide awareness campaign that used onsite and virtual workshops to educate factories on the severity of the risks at play, and on how to track and mitigate them through analytics. In addition, the team developed a weekly email report to help plants quickly identify and act on activity that could be leaving them vulnerable.

Lastly, our transformation specialists established a transformation management office to coordinate new security tool installations across the globe, establish a manufacturing security governance structure, and lead efforts to build a more cyber-aware culture on the shop floor. These efforts involved bringing together stakeholders who had very different security priorities and managing multiple vendors to ensure a smooth and cohesive program implementation.

As a result of our efforts, the client identified major network infrastructure issues, as well as challenges with visibility into potentially malicious or risky behaviors within their manufacturing environment. The client discovered more than half of incidents were caused by portable devices such as employees’ smartphones and vendor portable media that, unknowingly infected with malware, were plugged into company computers.

This visibility and insight allowed the client to shift focus and put a larger emphasis on insider and portable device-related threats. Through these initiatives, a monitoring program was implemented to identify sites with excessive risky behavior, and the volume of such threats has dramatically decreased. Improvements include:

• A greater than 80% reduction of devices with less secure, legacy operating systems accessing the internet
• About a 95% reduction in users accessing potentially unsafe websites (e.g., shopping, social networking, gambling)
• A nearly 100% reduction in users accessing potentially malicious websites (e.g., remote access tools, hacking, malicious sources [malnet], malicious outbound data [botnet])

The journey to secure critical manufacturing systems is never-ending and, as threats evolve, so must defensive techniques. Our work with this client continues through driving transformation efforts, enhancing threat detection capabilities, developing additional custom analytics dashboards, visiting plants for continued education on new cybersecurity tools, and providing enhanced visibility into activities occurring within the manufacturing environment.