Mastering the Conversation: Effectively Communicating OT Cybersecurity Risks and Investment Strategies to Food and Beverage Executives

In the latter half of 2024, phishing messages skyrocketed by 202% compared to 2023, as reported by SlashNext’s 2024 Phishing Intelligence Report. This surge is especially crucial for food manufacturers, as many operational technology (OT) devices link to corporate IT networks. Cybercriminals can easily access the plant’s floor through these phishing attempts.

A report from Food Engineering highlights that one major threat faced by food manufacturers is inadequate authorization. Poor security measures allow unauthorized individuals to infiltrate OT systems, making companies increasingly vulnerable.

Many food manufacturers still rely on outdated security measures. It’s vital to address this gap by investing in OT network security. Here’s how manufacturers can persuade their boards to back these investments.

Communicating Risks to Leadership

As we approach 2025, food manufacturers’ OT networks remain exposed. A misconception among many board members is that their corporate IT networks are safe. However, IT and OT networks operate differently and necessitate distinct approaches to security.

A recent Food Engineering webinar led by Patrick O’Brien from exida revealed that only 33% of attendees had conducted an OT cybersecurity risk assessment. In contrast, 55% had assessed IT risks. “This shows many companies prioritize IT but overlook OT,” O’Brien noted. This imbalance stems from various factors, including unclear guidelines from chief information security officers (CISOs) and a lack of executive support.

Identifying risks linked to production is another hurdle. Grant Geyer, chief strategy officer at Claroty, emphasizes the importance of connecting cybersecurity risks to metrics that matter to leadership. “CISOs must present risks in terms the board understands,” he explained. If they can relate cybersecurity to operational risks, they’re more likely to gain support.

CISO Robert M. Lee from Dragos also stressed the need for clarity in conversations with boards. He suggests simplifying discussions around risk acceptance and mitigation. If security technology requirements become too complicated, board members may lose focus, leading to ineffective strategies.

Recent discussions reflect that boards often look to their peers for benchmarking. They examine what similar companies are doing to remain secure, guiding their own decisions.

Trends in Cybersecurity Investment

According to Alexandre Peixoto from Emerson, there are two approaches to cybersecurity: “cyber-for-protection” and “cyber-for-convenience.” Cyber-for-protection focuses on robust defenses between IT and OT networks, primarily aimed at preventing attacks that could disrupt operations. In contrast, cyber-for-convenience integrates new technologies like Managed Detection and Response (MDR) to enhance security while allowing for some flexibility.

Geyer notes that the board’s interest can be captured by framing security investments in terms of operational benefits. “They want to hear about how we reduce risk while keeping operations running smoothly,” he said.

Dragos’ 2025 OT/ICS Cybersecurity Report highlights a growing interest in protecting low-level connected devices such as programmable logic controllers (PLCs) and fieldbuses. Many of these devices are vulnerable due to outdated design and lack detection mechanisms, a risk termed “turducken” protocols.

As systems in the food and beverage sector become more interconnected, these vulnerabilities will continue to pose risks. Leaders must clearly communicate the potential impacts of these risks on production.

The imperative now is to strengthen security for user-to-machine, machine-to-machine, and cloud-to-machine communications. Geyer emphasizes that security leaders need to adapt to ensure responsible execution of Industry 4.0 goals amidst evolving risks.

Conclusion

The food manufacturing sector faces escalating cybersecurity threats. As the landscape changes, organizations must prioritize and invest in robust security measures for their OT networks. Clear communication of risks and benefits is essential to gain board support for necessary advancements. By understanding the unique challenges and aligning security initiatives with company goals, food manufacturers can better protect their operations in a digital age.

Source link

cybersecurity,OT,operational technology,investments