Reinforcing Cyber Resilience in Manufacturing: A Defense-in-Depth Approach
In today’s era of accelerated digital transformation and interconnectivity, securing industrial control systems has become a paramount concern. Cybercriminals are growing increasingly sophisticated, exploiting new attack vectors to target manufacturing operations. As a result, the need for a robust, multi-layered cybersecurity strategy has never been more critical. For three consecutive years now, manufacturing has been the most targeted sector globally by cyberattacks, comprising a staggering 25.7% of incidents.
Recently, NanoLock Security joined forces with our partner CGI to explore this vital topic in an insightful discussion in a series of NanoLock’s OT Security Talk titled “Securing the Industrial Control Layer: A Defense-in-Depth Approach.” The session featured Faustino Rivero, Cybersecurity and Data Protection Manager at CGI, and Thierry Kolton, General Manager for Europe at NanoLock Security.
From left, clockwise: Thierry Kolton (Speaker – NanoLock Security), Davina Hammel (Moderator – NanoLock Security), Faustino (Speaker – CGI).
Faustino Rivero, emphasized that cybersecurity in manufacturing has fundamentally evolved in recent years. Achieving mere cyber protection is no longer sufficient – organizations must cultivate an overarching cyber resilience mindset and capabilities. This shift has been catalyzed by the wave of digital transformation initiatives, the proliferation of new technologies, increased IT/OT convergence, and the resulting expansion of attack surfaces that broaden exposure.
Highlighting the manufacturing sector’s urgent need to evolve beyond traditional cybersecurity measures, Faustino emphasized the necessity of cultivating a culture of cyber resilience, and outlined five key dimensions manufacturing organizations must address to build effective cyber resilience:
- Strategic prioritization of cybersecurity as a core business imperative
- Overcoming technical challenges stemming from legacy systems and outdated software
- Navigating an increasingly complex regulatory landscape
- Fostering organizational culture and governance
- Managing cyber risks across the supply chain
On the regulatory front, manufacturing firms now face a labyrinth of cybersecurity and safety standards they must adhere to. New EU regulations like the Cyber Resilience Act (CRA), NIS2 Directive, Critical Entities Resilience (CER) directive, and UNECE vehicle cybersecurity provisions have raised the compliance bar. With companies having less than 18 months to prepare for NIS2 requirements, the time to act is now.
A Unified Approach to Streamlining Compliance
Manufacturers need to adopt a unified strategy for efficiently meeting an increasingly stringent array of cybersecurity and safety regulations. Faustino advocated for a “unified approach” that enables streamlined compliance through a “test once and comply to many” model, reducing the overhead burden of multiple verification processes. He also spotlighted guiding principles for cultivating a cyber resilience culture, like integrating it by design into products and processes, continuously improving operational assets, implementing defensible architectures, and ensuring effective incident response. This unified framework can substantially reduce the resource burden while strengthening an organization’s overall cyber resilience posture.
The Importance of Device-Level Protection
Thierry Kolton, General Manager of Europe at NanoLock, emphasized the critical role of device-level protection for securing the industrial control layer. With Programmable Logic Controllers (PLCs) and other ICS/OT (Industrial Control Systems/Operational Technology) assets being ground zero for attacks aimed at disrupting operations, it is essential to implement proactive preventive controls at this foundational level beneath traditional network detection/monitoring solutions. As Thierry explained, PLCs are a prime target for threat actors, yet they often lack robust protection mechanisms. Simple human error or successful manipulation of these vital automation components could cripple operations.
NanoLock Security’s OT Defender device-level cybersecurity and operational integrity solution delivers robust access control, authentication, authorization capabilities and secure PLC program change management across multi-vendor environments. It further provides traceability, visibility and centralized auditing of all PLC activities to protect against insider threats, human errors, and supply chain risks from third-party contractors.
As cyber threats continue escalating in sophistication and manufacturing further embraces technologies like AI, GenAI and 5G that expand attack surfaces, robust cyber resilience will be mission-critical for operational continuity. Implementing a defense-in-depth strategy anchored by device-level protection establishes a strong foundation to manage cyber risk across this increasingly interconnected digital ecosystem.
Missed this insightful session? Access the full recording and presentation on-demand to gain a deeper understanding of the key pillars of system integrity and defense-in-depth strategies for the industrial control layer, here.
