David Atkinson, UK Head of Manufacturing SME & Mid Corporates, Lloyds, sits down with colleague Giles Taylor, Head of Resilience and Cyber Security, to discuss why so many manufacturers are being targeted in cyberattacks.
David Atkinson: “The UK manufacturing sector has become a key focus for cybercrime. Why are manufacturers such an attractive target in 2024?”
Giles Taylor: “Manufacturing has replaced financial services as the most targeted sector, partly because financial services firms have invested heavily in cybersecurity and are now well protected. But it’s also because manufacturers are digitising their operations, which means they have more connected technology that can be attacked.
“All kinds of machinery now have sensors to help optimise production, which are all potential points of entry for hackers. At the same time, many manufacturers have legacy equipment, with software that is no longer getting the latest security updates, which also creates vulnerabilities.”
David Atkinson: “So, who are committing these cyberattacks and why?”
Giles Taylor: “At the highest level, there are nation states that are engaged in cyber espionage. Then there are the organised criminal gangs, which are in it for the money, and ransomware is their primary tool.
“Their strategy used to be to simply hold firms’ systems and data to ransom, but they have now realised they can demand a second ransom by threatening to release the data that they have stolen, and even a third ransom by threatening to make their attack public. This is known as triple extortion.”
David Atkinson: “And what options do firms have in situations like these?”
Giles Taylor: “If you have cyber insurance, your insurer will support your recovery. If not, then you will need to consider engaging legal, PR and cyber incident response teams to help recover your business.
“You may also consider reporting the attack to Action Fraud, the national reporting centre for cybercrime, and your bank, to see how it can support the additional demands on finance.”
David Atkinson: “And what are the implications if your data and systems are exploited?”
Giles Taylor: “That depends. If either your IT/office systems or manufacturing systems are attacked, then you may not be able to continue business and you can be exposed to fraud or other criminal acts. You could also be fined by the Information Commissioners Office if people’s personal data is put at risk.
“That’s beyond the challenges of getting your operations back up and running. Any downtime can mean you breach your contractual obligations to your clients, who you may have to compensate. There can be regulatory fines too.
“Insurance can help mitigate some of this risk, but any payout will only get you back to where you were before the attack. You’ll then need to invest to improve your defences, or you will remain vulnerable.”
David Atkinson: “How does the Cyber Resilience Act play into this?”
Giles Taylor: “It obliges you to ensure that your products are cyber secure. Electronic devices, for example, have to be appropriately protected, which could mean providing security updates and support for years to come.”
David Atkinson: “So, as a manufacturer, what should your strategy be in the face of this cyber threat?”
Giles Taylor: “It’s all about risk management; turning your organisation into an impenetrable fortress is not realistic.
“But manufacturers can take steps to make sure they can recover as quickly as possible. That starts with identifying your most important business assets and focusing to protect these.
“If your strength is your intellectual property, for example, then you can make sure that is encrypted and has strong access controls. But if your priority is to make sure production can continue uninterrupted, then having offline backups so you can restore systems quickly will be more important.
“As a management team, you need to have a robust response plan that should include financial aspects, including working capital and cash flow, as well as operational, reputational and legal, and consider if cyber insurance would be beneficial.
“Lloyds has created a free Cyber Risk Guidance document that lays out the safeguarding steps in a very practical way.
“For me, the key message is that this is a real and present threat and you need to understand the key risks for your business, because every manufacturer is different.”
To download Lloyds’ Cyber Risk Guidance visit lloydsbank.com/cyber
Lloyds and Lloyds Bank are trading names of Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone: 0207 626 1500. Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under Registration Number 119278.
For more articles like this, visit our Leadership channel.
