🏭 Cybersecurity in Manufacturing: How Do You Protect Production with Small Teams? 🛡️

[Erkan Teskancan]

Rising Threats in the Manufacturing Sector and the Burden on Small Teams​

The manufacturing sector continues to be the most targeted area for cyberattacks over the past five years. While Common Vulnerabilities and Exposures (CVEs) reach record levels, the pre-attack detection time in industrial ecosystems exceeds 40 days. This situation places a significant burden on security teams that already have limited resources.

A recent survey revealed that in most medium-sized businesses, the number of people responsible for network monitoring is only 2 to 5. These small teams are expected to manage the corporate network, production lines, and newly connected legacy machines simultaneously. Among the overwhelmed teams, 58% view anomaly detection as the most valuable feature, while 40% desire smarter alert noise reduction.

Achieving More with Fewer Resources: The Role of Automation​

With the emergence of new AI-powered threats, the expectation to "do more with less" is increasing. To achieve this goal, small teams are looking for ways to allow intelligent systems to securely take on some of the monitoring burden.

According to survey results, approximately 75% of medium-sized businesses have only 2 to 5 people responsible for monitoring. Even in large and distributed organizations, only one-sixth integrate OT (Operational Technology) and industrial systems into a single view. This indicates that, regardless of company size, the production floor is still largely monitored separately, which can lead to data and decision-making silos.

While network metrics are often collected automatically, most teams struggle to analyze and interpret them. For example, a traffic surge during production can look the same as malicious activity at a fixed threshold. Such false positives can mislead managers. Legacy infrastructures further complicate this problem.

Alleviating the Burden with Automation​

Teams that allow the system to be the first watchful eye and proactively address low-level vulnerabilities are best positioned to preserve managers' scarce attention. Automated controls and noise filtering have an immediately noticeable impact in this regard. For example, in converged IT and OT networks, intelligent systems can make it easier to ensure assets are functioning normally and periodically check software and hardware status. Such automation can also reduce alert fatigue when a problem does arise.

Setting clear thresholds for network activity is a good way to define what "normal" looks like. Over time, weekly patterns paint a picture of regular activity. This also works with PLCs by monitoring logs and gateways for scan time, I/O status, CPU, and memory indicators. Information from controllers and everything they communicate can suggest regular performance and flag when something is operating unusually.

For more serious incidents, intelligent systems inform the team for closer inspection. For example, at a global food processor, PRTG network alerts fed into the SCADA system enabled proactive action when a switch supporting a critical refrigeration controller began to fail.

Intelligent monitoring proves valuable in determining what and when to pay attention to. Most decision-making processes – especially in situations involving control logic and security systems – remain with the manager to have the final say. The key benefit is keeping humans in the loop while eliminating drudgery.

Rebalancing the Security Equation in Manufacturing​

Most automated monitoring requires a modern posture and a strong foundation for the best results. Even before automation, managers must create the conditions for success by understanding everything under their purview and prioritizing assets by criticality. Core switches and production line controllers will likely receive the tightest monitoring, especially since hackers know that targeting these tried-and-tested production assets leads to costly downtime.

Similarly, baseline a full production cycle before alerting for deviations. Otherwise, shift changes and maintenance windows will appear as false anomalies. And route alerts to the individuals who own the asset and where they are already looking, so they don't have to check a second dashboard.

Teams also need to be realistic: automated monitoring gives manufacturing teams an advantage but can't handle everything. Instead, think of it as another (powerful) tool that saves time and augments, rather than replaces, judgment. Review performance and implementation quarterly and share this with leadership to demonstrate ROI.

Here, while making the case for more monitoring resources, also bring compliance into the loop. About half of respondents indicate that compliance is a critical or important factor when selecting monitoring tools. Recorded alerts, uptime logs, and review notes are key to demonstrating compliance with NIST CSF and SOC 2. Making this paper trail easily accessible to both company leaders and auditors removes another item from managers' to-do lists.

Achieving with a Five-Person Team​

Smaller teams in this sector need to make a bigger impact. As the security landscape continues to worsen, monitoring teams of five or fewer people need systems to help them do the heavy lifting. Understanding performance and quickly uncovering the biggest threats makes a difference in this new network normal.