Addressing industrial cybersecurity risk affecting the industry - Paper Technology International 2023 - Paper Technology International 2023 - Flipbook - Page 76

Addressing industrial cybersecurity risk affecting the industry - Paper Technology International 2023

PAPERTECHNOLOGYINTERNATIONAL
Addressing industrial cybersecurity risk affecting the industry - Paper Technology International 2023
ANDRITZ’s steam recovery systems enable the
efficient capture and reuse of surplus steam energy, reducing a
manufacturing plant’s fuel and boiler feed water consumption.
Industrial burner solutions also supply pulp and paper mills with
energy by repurposing industrial waste and biofuels to generate
energy and reduce CO2 emissions. Industrial machinery in pulp and
paper plants that support energy production, capture, or reuse can
also affect worker safety if malicious actors breach OT or IT systems
controlling their operation.
Safeguarding and having visibility into your IT and OT assets
is vital. Without effective OT security, malicious cyber actors are
more likely to breach security configurations in industrial assets
like boiler generators, steam recovery systems, and fuel systems.
Such breaches can impact worker safety, day-to-day
operations, regulatory compliance, and more.
Preventing cyber risks from third parties
Your pulp and paper business uses
third-party software solutions and
works with contractors who might be
a source of accidental or malicious
cyber incidents. Contractors
help service your heavy
machinery, integrate new
equipment and processes, and
interface with power, utility, and
energy systems on which your
organization depends.
Contractors are often unaware
of cyber risks and can introduce
vulnerability into your networks. An effective
OT security risk management solution will
identify such threats and help you implement
safety practices to prevent them from being
exploited.
Pulp and paper companies should be very aware
of potential risks introduced by supply chain dependencies.
In cases where products rely on third-party solutions or
services to operate, the company should customize systems to
minimize their use and risk of exposure. Assess all your third-party
products and providers associated with your business operations
with a comprehensive due diligence program.
Practice makes perfect: Disaster recovery exercises
Every pulp and paper manufacturer needs to have a disaster
recovery plan (DRP) and a backup plan in place. The most effective
way to recover from an industrial cyber attack is to practice your
DRP and backup plans often.
•
•
•
•
You’ll get answers to these questions when your IT and
plant’s operations technology teams practice getting backed-up
data, manufacturing equipment, processes, and production up and
running again. Like athletes, military personnel, and actors,
DRP practice will help get your pulp and paper company
ready for a real cyber attack.
After a practice drill, you’ll be able to answer these
questions: How long did it take your teams to simulate a
successful recovery? What lessons
were learned? Using these insights, you can go
back and repeat your DRP.
Why employee cyber hygiene is important
It is imperative that every pulp and paper company require
its employees to practice basic cyber hygiene. At a minimum, this
means workers should a) use multi-factor authentication (MFA) for
remote access to the company’s network, b) control user-access
management, and c) use reliable anti-virus and firewall solutions.
Hackers frequently try to gain access to a company’s IT and
OT networks via -’phishing’- campaigns that target employees’
corporate email and social media
accounts. These attack strategies
often ask employees to ‘confirm’
Do your IT and OT teams regularly back up network data and
their account login details, including
secure these backups?
their passwords. If an employee
Do you know how often backups are done and where your data shares such secure credentials,
this may give malicious actors
is stored (e.g., locally, offsite, or in multiple locations)?
access to the employee’s account
and provide remote access to
Does your company hold regularly-scheduled disaster
the company’s internal network,
recovery exercises every quarter?
databases, industrial operations,
and machinery.
When a zero-hour or zero-day attack happens, will your DRP
actually work?
76

Paperturn flipbook system