Recent developments in OT (operational technology) and IT (information technology) have spanned an ecosystem of automated and highly interconnected systems in the manufacturing industry. These digital systems create an avenue for the threat actors to modernize their tactics and directly target these systems if the underlying security issues are not addressed.
In recent years, the manufacturing industry has had its fair share of ransomware attacks which is a wake-up call for the key stakeholders and decision-makers to act decisively and implement backup and disaster recovery solutions and best security practices to reduce their attack surface.
According to a research, almost 21% of all ransomware attacks were targeted at the manufacturing sector. Six in ten organizations in the manufacturing industry believe that they struggle to keep their systems secure against ransomware, and almost 50% believe that they will be hit by ransomware in the near future.
These statistics are alarming, and businesses need agile ransomware-proof backup and disaster recovery recovery solutions built into their data protection infrastructure to secure themselves from ransomware attacks, malware, viruses, and hackers.
This blog post will discuss why the manufacturing industry is a target for threat actors, its repercussions and how manufacturing companies can prepare for ransomware.
Why is the Manufacturing Industry Among the Top Targets of Ransomware?
The manufacturing industry has become a prime target for cybercriminals, with ransomware attacks witnessing a significant surge. According to the NTT report released in May 2021, there has been a staggering 300% increase in ransomware attacks on the manufacturing sector compared to the previous year.
So, why is the manufacturing sector an attractive target for these attacks? Several factors contribute to this:
Complex Systems and Valuable Data at Stake
The manufacturing industry faces unique cybersecurity challenges due to its complex and interconnected nature. Attackers target manufacturing organizations because of the valuable intellectual property and sensitive data they possess. Additionally, the increasing connectivity of industrial control systems and the adoption of IoT devices create potential entry points for cyber threats. Manufacturers must implement robust security measures to protect against ransomware attacks and safeguard their operations, intellectual property, and customer data.
Economic Impact of Project Delays in the Manufacturing Sector
Manufacturing organizations face significant economic consequences due to project delays, making them attractive targets for ransomware attacks. Attackers exploit this vulnerability, knowing that time is crucial in the industry. The potential for substantial financial losses pushes organizations into a difficult position, often resorting to paying the ransom to minimize further disruptions.
Impact of Limited Security Workforces and Subpar Systems in Manufacturing
The manufacturing sector, compelled by the demands of the fast-paced industry, often faces limitations in its IT workforce. The reduced staffing levels make it challenging to keep up with the evolving tactics of cybercriminals. Moreover, the sector’s focus on operational efficiency often takes precedence over comprehensive security measures, resulting in subpar security systems. This combination creates a vast network of systems with inadequate protection, widening the attack surface for ransomware threats. Even organizations that implement backup and recovery systems can still fall victim to modern ransomware, which increasingly targets backups.
To bolster data security, industry leaders are turning to technologies like immutable storage and air-gapped backups, both on-premises and in the cloud, as the new gold standards.
Risks Posed by Ransomware in Manufacturing Environments
The manufacturing industry faces significant risks when it comes to ransomware attacks due to its increasing reliance on digital systems and interconnected infrastructure. Any cyber-attack can have far-reaching consequences, disrupting critical services, manufacturing equipment, and devices that rely on these interconnected systems. For example, network-based file sharing is vital for transferring crucial manufacturing data, such as workflows, engineering documents, and purchase orders. Disruption of such services can cause chaos within the organization. While the production line may not be directly affected, operations like engineering and design can suffer, depending on network segmentation strategies.
Network Unavailability and Disruption
Network unavailability and disruption are also major concerns. Some threat actors go beyond data theft and include disruptive capabilities in their ransomware payloads, such as launching Distributed Denial of Service (DDoS) attacks that flood automation networks with random data packets, paralyzing critical systems. This can lead to issues like blocking access to utility systems, disrupting power supply to human-machine interfaces, and impacting overall operations.
Operational Reliance on Internet of Things (IoT) Devices
The reliance on IoT devices for operational technology (OT) introduces another risk. Many manufacturing organizations still use legacy OT systems with inadequate security measures, providing an entry point for attackers to target IoT devices and pivot to critical industrial systems. Additionally, the industry’s extensive supply chain involves collaboration with numerous third parties, making it susceptible to supply chain attacks triggered by successful ransomware compromises. The impact of intellectual property theft can reverberate throughout the industry, leading to a cascading effect.
The Impact of Ransomware on the Manufacturing Sector
According to the Sophos Survey titled “The State of Ransomware in Manufacturing and Production 2021,”:
- Almost 36% of organizations in the manufacturing sector were hit by ransomware in the last year.
- Attackers were successful in encrypting the data of 49% of their victims.
- 19% of those victims had no choice but to pay the ransom and eventually paid the ransom.
- Only 55% of data was restored after the payment of ransom, leaving nearly half of the data either inaccessible, corrupted, or lost.
- 89% of organizations had a recovery plan in case of a ransomware attack.
According to the “X-Force Threat Intelligence Index 2022” report by IBM:
- There is a 33% increase in ransomware incidents within the manufacturing industry caused primarily by exploiting common vulnerabilities that organizations failed to patch.
- The most common method to infect the systems was through phishing.
- The second common vulnerability exploited was the Log4j vulnerability.
- In terms of industries with OT networks, manufacturing was the most targeted in 2021 by victimizing almost 60% of their victims.
- 36% of attacks on the OT networks were ransomware attacks, 18% were server access-based attacks, 11% were DDoS attacks, and 9% of attacks comprised credential harvesting, insider jobs, and RATs, while Botnets victimized 4%. The remaining 2% were affected by worms and webshell exploits.
Significant Ransomware Attacks on the Manufacturing Industry
Let’s analyze recent ransomware attacks to gain insights into the dynamics of ransomware incidents in manufacturing. These real-world examples are a stark reminder that even organizations with robust security measures can fall prey to determined threat actors. In each of the following incidents, the adversaries achieved their objectives by successfully encrypting or exfiltrating sensitive data from the targeted organizations.
Examining these cases provides valuable lessons and underscores the critical importance of proactive cybersecurity measures.
- Visser Precision, an aerospace parts manufacturer with ties to high-profile firms like Tesla, General Dynamics, and SpaceX, fell victim to a ransomware attack in 2020. The DoppelPaymer malware encrypted the company’s data and cut off access to critical systems, including fixed, removable, and network-attached drives. Following the encryption, the organization’s servers were rebooted including access to vital services was locked.
- In 2021, Acer experienced a ransomware attack orchestrated by the REvil group. Exploiting a vulnerability in Microsoft Exchange, the threat actors encrypted essential data and demanded a staggering $50 million ransom in exchange for the decryption key. This amount set a new record in the history of cybercrime. Furthermore, Acer encountered two cyber-attacks later in the same year.
- On February 23rd, 2022, Nvidia, the chip manufacturing giant, fell victim to the Lapsus$ group. The attackers claimed to have stolen 1TB of Nvidia’s proprietary data and threatened to publish it. They also obtained employee credentials and released some stolen data as evidence. Although ransomware was not deployed, the attackers had unauthorized access to Nvidia’s systems for approximately a week without the company’s knowledge.
- On January 5th, 2022, the threat actors affiliated with Ransomhouse revealed that they had breached AMD’s network and exfiltrated over 450 GB of data. Along with an alleged list of weak AMD corporate credentials that facilitated the attackers’ infiltration, this included information on 70,000 devices within AMD’s internal network.
How the Manufacturing Sector can Prepare and Protect Against Ransomware Attacks?
The continuous wave of ransomware attacks and data breaches highlights the vulnerability of the manufacturing industry. Organizations must adopt a proactive approach to protect data from ransomware and prevent data loss and downtime.
With ransomware becoming increasingly sophisticated, manufacturing organizations must implement robust defense strategies. Once data is encrypted, the options for recovery are limited, with even backups becoming targets for ransomware encryption.
A combination of on-premises and cloud-hosted solutions is recommended to establish a comprehensive backup and disaster recovery (DR) solution. When selecting a service provider for backup and DR, the following factors should be considered:
- Air Gapping: The solution must include air gapping, which ensures that backups are isolated from the production environment, safeguarding them against ransomware encryption. This physical or logical separation adds an extra layer of protection.
- Immutability: The backup and DR solution must offer immutability, ensuring that critical workloads, whether on-premises or in the cloud, are protected against unauthorized alterations. Immutability prevents ransomware from tampering with or encrypting crucial data.
- Data Encryption: The solution should support end-to-end encryption techniques such as AES 256-bit encryption for data at rest, and SSL tunneling for data in transit. This ensures that even if data is intercepted, it remains useless to attackers, maintaining the confidentiality and integrity of the information.
- Service Level Agreement (SLA): Given the fast-paced nature of the manufacturing industry, the chosen solution should guarantee the required SLA. This ensures backup and DR operations align with the organization’s business objectives and minimize downtime.
- Recovery Time and Point Objectives (RTPOs): The solution should meet the required RTPOs, enabling quick failover and failback of workloads. By minimizing the time to recover and restore operations, manufacturing organizations can mitigate the impact of ransomware attacks and resume normal business activities promptly.
Data Protection in Manufacturing: How StoneFly Mitigates Ransomware Risks
To effectively defend against ransomware attacks and ensure data protection in the manufacturing industry, StoneFly offers ransomware-proof turnkey backup and disaster recovery solutions. These solutions are designed to provide comprehensive data backup, recovery, and ransomware protection capabilities.
Let’s explore three solutions:
- StoneFly DR365V is a Veeam-ready air-gapped and immutable backup and disaster recovery solution. It enables organizations to protect their critical data and quickly recover from potential ransomware attacks. This solution ensures seamless replication, encryption, and point-in-time recovery, empowering manufacturing businesses to mitigate the risks associated with data loss and downtime.
- StoneFly DR365VIVA introduces purpose-built air-gapped and immutable nodes with a built-in power and network management controller. These nodes provide enhanced security by allowing storage administrators to set policies that automatically detach the appliance from the network. When detached, the node becomes invisible to production, reducing the attack surface and safeguarding critical manufacturing data from ransomware threats.
- StoneFly collaborates with Veeam to offer a backup solution that utilizes Azure cloud storage. With Veeam Cloud Connect backup to Azure, manufacturing organizations can leverage StoneFly storage in Azure, which incorporates air-gapped and immutable features and other ransomware protection mechanisms. This solution enables seamless backup and recovery operations, ensuring data integrity and resilience in the face of potential ransomware incidents.
These solutions provide the tools and capabilities to mitigate risks, maintain business continuity, and safeguard critical manufacturing data from malicious threats.
Conclusion
The manufacturing industry faces a growing menace of ransomware attacks, endangering their operations, data security, and intellectual property. To counter these threats, a proactive approach is crucial. Robust security measures, including StoneFly’s DR365V, DR365VIVA, and Veeam Cloud Connect Backup to Azure, offer vital protection with features such as data backup, immutability, and air-gapped storage.
Alongside these solutions, employee education, regular system updates, and risk assessments play key roles. By adopting a multi-layered security strategy, manufacturers can enhance resilience and mitigate the risks of ransomware attacks.
Vigilance, continuous evaluation of security measures, and trusted partnerships are essential in staying ahead of cybercriminals. Protecting valuable assets and ensuring uninterrupted operations demand an unwavering commitment to data security in the face of evolving threats.
Secure your vital workflows, engineering documents, and sensitive intellectual property with reliable backup and disaster recovery solutions. Talk to our experts to discuss your project(s) today!
