Cyber security in the digitalising factory

As digitalisation is accelerating continuously, the threat of cyber attacks has spread to the operational technology (OT; control and operation technology for production lines and systems) environment, which is the foundation of business activities. It is well known that cyber security incidents in factories and other OT environments have been occurring in Japan as well. PwC views OT security incidents that will threaten the very existence of companies and cyber security measures in the OT environment that prevent such incidents (‘OT security’) as important management issues.

Generally, knowledge of OT security is insufficient and companies with supply chains and manufacturing bases are struggling to promote it. This report explains important points and perspectives that companies need to consider in promoting OT security to help advance safe and secure business operations.

Table of contents

1. Introduction
2. Categorisation and OT security in Factory (OT) environments
   Categorisation of OT environments
   Points to note in OT security
3. Security governance at factories (OT) – Building a security management system emphasising the on-site capability
   Importance of OT security governance
   Important points in OT security governance
   Roles that OT security governing organisation should play
4. OT security assessment from an attacker’s perspective using ATT&CK for ICS
   Necessity of OT security assessment from an attacker’s perspective
   Points to note in the assessment
   ATT&CK for ICS to help assess OT security
5. The importance of reference modelling of security architecture in factory (OT) environments
   What is required for OT security
   Benefits of reference modelling
   Requirements for reference modelling
6. Security personnel in the factory (OT) areas
   Security personnel required for OT environment
   OT security personnel acquisition strategy
7. Advanced cyber attacks targeting OT environments
   and countermeasures
   Alerts by US government agency
   What kind of attack is it? What aspects are advanced?
   How to defend against attacks
8. In conclusion