As a result of the coronavirus pandemic, many governments have imposed social distancing techniques to slow the spread of the virus. These techniques include closing schools and retail outlets, and asking people to work from home unless absolutely necessary. Consequently, COVID-19 has caused an acute shift in work practices and accelerated the adoption of digital transformation across governments, businesses and societies.

Although the pandemic has caused a major change to how many businesses operate, the concept of remote working has been around, and growing in popularity, for the best part of a decade. For instance, a 2019 study by International Workplace Group found globally, that 50 per cent of employees work away from their office at least two days a week, while analysts predict that up to half of the workforce will be freelance and working remotely, within 10 years. Indeed, even before the virus caused so many to work from home, an IFSEC Global State of Technology 2020 report found that 94% of businesses in the UK said that they were seeing a growth in remote workers. The popularity of remote working pre-COVID-19 was mainly due to improvements in technology that made it easy to work away from the office. Networks, smart phones, cloud data storage and wifi means many can access the information they need on the move and as such, the fourth industrial revolution (4IR) brought with it an unprecedented ability to share data and work collaboratively. But it also created a new realm for criminals. Increasingly sophisticated hackers and adversaries are actively trying to steal data for profit, knowledge or disruption. Indeed, according to the ‘2019 Official Annual Cybercrime Report’ conducted before the pandemic estimates that by 2021, the direct damages of cybercrime would cost the global economy $6 trillion, or 6.3% annually. 

 

Therefore, as the entire world switches to remote working – even though much of it may be temporary – cybercrime has become one of the greatest risks to global economic recovery and eventual growth. Since the coronavirus began, social engineering attacks (phishing, vishing and via social media, etc.) have risen significantly, indeed, more than one third (36%) of executives on the CNBC Technology Executive Council say that cyberthreats have increased during the COVID-19 outbreak, as a majority of employees work from home. “Organisations of all kinds are facing an uptick in email-based threats, endpoint-security gaps and other problems as a result of the sudden switch to a fully remote workforce,” says William Altman, Senior Analyst at the Global Cyber Center of NYC, operated by SOSA. As Miriam Wugmeister, partner and co-chair of Morrison & Foerster’s global privacy and data security group explains; “The bad guys know that every IT department and every cybersecurity group is currently overwhelmed and stretched.” So how can manufacturing organisations protect themselves from the increased risk of cyberattacks during the pandemic? Firstly, many cyber-security advisers recommend manufacturers move their systems to the cloud to ensure data remains encrypted and protected wherever staff are located. “The use of virtual environments, like the cloud, is key to providing capacity, security and flexibility” says Alex Schlager, chief product officer in the cyber-security group at Verizon. 

 

To move information and networks on to the cloud requires significant investment in software and networking infrastructure but once in place, the organisation has a far higher ability to protect against an attack. Secondly, manufacturers must also tightly control who has access to their data, and for how long. Along complex industrial supply chains, information and data is shared continuously and yet it is critical that each organisation is fully aware of what information is being shared and how. “Without having control over who has access to what, when and under which circumstances, data and the wider network will be put at greater risk of human error and malicious attack,” says Chris Miller, regional director for the UK and Ireland at RSA Security. Therefore, manufacturers must have in place a data policy that ensures data flows freely where necessary, and yet is protected fully against hackers through firewalls, strong passwords and secure networks. Thirdly, security experts also recommend that manufacturing organisations with employees working from home provide company computers and devices with security software and systems already built within. “One of the biggest risks of the new ways of working is ‘BYOD’,” or bring your own device, says Justin Harvey, global incident response lead in the security division of consultancy Accenture. 

 

“Companies are paying millions of dollars a year to protect their systems through firewalls, intrusion detection and antivirus software, but when you introduce BYOD, you are essentially trusting that your employees are taking the right precautions.” And yet, employees’ own computers rarely have the same protections, nor the same capabilities for monitoring activity as work devices. Using company devices ensures that certain basic security protocols protect organisational data company-wide, and also help security team with early detection of a breach when monitoring the network. Fourthly – although perhaps most critically for the manufacturing sector – it is also vital that in the age of the Industrial Internet of Things (IIOT) and smart factories, that all networked machinery and systems are protected against hacks both individually, and when linked to the network. Allowing gaps in the system creates the opportunity for hackers to disrupt production, cause accidents or steal data. While the onus is on manufacturers to protect their data and systems, governments also share the burden of responsibility by ensuring regulations and legislation are kept current so criminals can be identified, apprehended and brought to justice. Yet despite efforts, a recent report found a “stunning enforcement gap” for cybercrime, citing that even in the US, a market with sophisticated cyber-security law enforcement teams, the likelihood of successfully prosecuting a cybercrime is estimated at 0.05%, far below the 46% rate of prosecution for violent crime. 

 

This gap is predominantly due to the nature of cybercrime, in that the perpetrator is often in a different jurisdiction to its target, requiring high levels of collaboration and cooperation between international law enforcement teams to catch the criminal and bring them to justice – a task that is often too challenging to achieve due to political or competitive reasons. Therefore, perhaps the best way to protect the security of organisations in the manufacturing sector and beyond is to encourage a multi-stakeholder approach to tackling cybercrime centered upon public-private sector cooperation. For example, where government agencies do not have jurisdiction to investigate crimes committed online to foreign entities, private companies with global operations can operate and investigate across national boundaries. Therefore, by combining private sector skills and infrastructure with law enforcement authorities’ power to arrest and prosecute, more can be done when a crime is committed. In some instances, this cooperation is already underway. INTERPOL, Europol and several national law enforcement authorities have stepped up their efforts to foster partnerships with the private sector, while other stakeholders such as the Cyber Threat Alliance, the Cyber Defence Alliance and the Global Cyber Alliance are creating frameworks of multi-stakeholder cooperation focused on a shared goal of minimising cyberattacks. 

 

As COVID-19 disrupts the world of work for the foreseeable future, it is vital that manufacturers, and organisations across the economy, take charge of their cybersecurity, managing the ever-changing risks of operating digitally. As while governments attempt to scale up a macro approach to escalating cybercrime as a result of the pandemic, keeping tight control of data and network access on a micro level, will serve as the best defence against potential attacks.