I came across an interesting article on the topic of business continuity written by Zac Amos, Features Editor at ReHack for the blog of ISA/GCA  on how useful it can be to equip your company with a “IT Emergency Plan” (IT/OT Contingency Plan).

We've been talking about for a long time Operational Continuity, or how to increase resilience in production departments, both in industry and in utilities, in order to avoid unplanned stops and mitigate risks and damages due to accidents or cyber attacks that may have impacts on the continuity and quality of industrial production or the provision of a service to the public.

Here are some considerations relating to the need to equip the company with an emergency plan and what the approach steps and tools that may be useful for its implementation.

Contingency Plan, Business Continuity Plan and Disaster Recovery Plan

Let's clarify the differences between Contingency Plan, Business Continuity Plan and Disaster Recovery Plan:

  • Emergency planning (Contingency Plan) occurs in advance to prepare for future incidents, therefore before .
  • Business Continuity Plan, i.e. the business continuity plan provides a temporary solution, during an accident.
  • Disaster Recovery Disaster recovery that focuses on restoring normal operations, after that an accident occurred
What is a cybersecurity contingency plan and why is it important to have one

A cybersecurity contingency plan is a set of procedures that a company initiates in the event of incidents and cyber attacks: using risk management through careful threat analysis, serves to guide employees and security teams to address a crisis digital, with thoughtful incident responses, including recovery of data that may be lost.

A company with a solid emergency plan for cybersecurity has a greater chance of counteracting incidents and cyber attacks and protecting systems, plants and machinery in production.

Incidents with data breaches, D-DOS attacks, data breaches and other cyber attacks are just some of the risks that every company, small or large, must prepare to face. The list goes on and a cybersecurity contingency plan can help mitigate these and other risks. That's why it's important to have a written and proceduralized cybersecurity contingency plan.

With a cybersecurity contingency plan, the Company:

  • Save time and resources: Major system and data breaches can be costly for any business. Criminals demand a ransom in exchange for restoring services or returning stolen data. Regulatory bodies can also issue fines and penalize Companies for failing to adequately protect information relating to their Customers and Suppliers (see GDPR, NIS2 etc.). On closer inspection, instead of being forced to pay a ransom and hire consultants to verify the damage, it may be better to invest resources to develop business strategies to better protect your assets.
  • Minimizes damage: A cybersecurity contingency plan reduces the chances of bad actors infiltrating systems, causing shutdowns, causing damage, and stealing valuable data. And when systems do compromise, incident response plans can minimize the damage. Among the defense and protection measures for IT security there are certainly a precise and updated inventory of all devices, the backup of the software used and the data and the isolation of networks to make any infected devices harmless.
  • Keeps facilities operational: Stops due to accidents and cyber attacks can be very damaging and have heavy impacts on any company with impacts on productivity which decreases and sometimes entire departments come to a standstill. Creating a cybersecurity contingency plan can help you prepare for such disruptions and keep machines and plants running to avoid further setbacks and loss of trust from employees, customers, investors and all stakeholders involved.
  • Improve business preparedness and resilience: Raising awareness, preparing and training teams to deal with incidents and cyber attacks helps maintain calm during these high-stress events. A well-crafted cybersecurity contingency plan outlines all possible scenarios and their solutions. Companies equipped with such contingency plans are more resilient and can resist attacks more effectively than others without them.
  • From rapid incident response: Timeliness is one of the most important points when you are involved in an accident or cyber attack. The longer criminals remain within systems, the more damage and chaos they can cause. Contingency plans help you respond to threats quickly and efficiently. The security team can identify attack patterns and use appropriate corrective actions to thwart cyber attacks as they occur.
Some preparatory steps for drafting an Emergency Plan
  1. Identify a manager and make his appointment official: this is the first step to make effective what will then be decided by him and will then be disseminated within the Company. Depending on the commitment required, adapt your team (and your budget).
  2. Identify the perimeter and composition of the systems on which the plan will be operational: this is also an important step and can be done manually if it involves a few systems in production, but it can also be very demanding and expensive in terms of resources and time if it involves large and complex systems. It may be necessary to equip yourself with Asset Inventory tools and carry out an Assessment of the IT resources and devices to be included in the plan to make sure that nothing is missed.
  3. The emergency plan tends to reduce the impacts of any stops and give the possibility of restarting quickly. Properly instructing people and equipping themselves with adequate tools is a prerequisite. We will see below that one of the essential points is to have the back-ups updated and checked to guarantee restarts. We therefore evaluate the importance of having a tool for managing the configurations of all field devices which can at the same time collect and manage backups and all versions of the software used by PLC, PC, robot, CNC, Switch, Firewall, DCS , HMI, SCADA, etc. used in production.
How to create a cybersecurity emergency plan in 6 steps

Creating a cyber attack contingency plan is critical to your organization's growth. Here are some points to include in your cybersecurity contingency plans.

  • 1. Identify and maintain updated systems

Legacy systems, outdated firewalls and countermeasures with outdated security plans make it easier for bad actors to infiltrate your company's digital systems. As far as possible, it is better to have an inventory of networked devices aligned with the most recent changes and that all security countermeasures are kept up to date: controlling and strengthening primary defenses increases the chances of effectively countering incidents and attacks. Here is a tool for Automated asset inventory and vulnerability management can be useful.

  • 2. Establish a strong chain of command

Every person involved in the Company must know who to report to in case of incidents and cyber attacks. An emergency management person must be appointed, such as a department head or the head of the IT and security teams. It is essential to keep communication channels open and educate employees on how to quickly report any incidents.

  • 3. Train employees on cybersecurity best practices

People, collaborators, often represent the weakest link of any organization's cybersecurity measures. The most suitable way is to create a culture of IT security in the company by training employees to safeguard all resources (and company credentials). For example, every member of the organization should know how to recognize phishing emails and other suspicious payloads.

  • 4. Stay up to date with the latest threat information

Bad actors typically use multiple attack vectors to infiltrate secure networks. Let's make sure that i Security teams are aware of the latest threats, with recent threat intelligence reports so they can identify attack patterns and suspicious activity as quickly as possible. Also in this case, a tool for managing vulnerabilities and threats with Anomaly Detection functions can be decisive.

  • 5. We perform and maintain backups of all devices

We make getting your data and operations back up and running a priority regularly backing up all critical resources that we have in production. Loss of control of systems and data breaches are ever-present possibilities in today's business landscape. Keeping assets safe will increase your chances of avoiding shutdowns, heavy losses (and heavy fines). As already indicated, it can be successful to adopt a solution for managing the configurations of all field devices which can at the same time collect manage backups and all versions of software used by PLC, PC, robot, CNC, Switch, Firewall, DCS, HMI, SCADA, etc.. used in production.

  • 6. Identify and quarantine infected devices

Hackers exploit every weakness in their target's network and organizational structure. Vulnerabilities in unprotected devices make it easier for attackers to compromise a system. It is therefore necessary identify and quarantine infected devices and practice network segmentation to minimize lateral movement of malicious third parties once they are inside the network. Devices are useful for this purpose Vulnerability Assessment and Anomaly Detection capable of actively segmenting the network and segregating critical devices, thus isolating "suspicious" ones for further in-depth investigations.

In conclusion

The cybersecurity emergency plan it is a necessity for any manufacturing company.

To protect the Company from digital threats, we should equip ourselves with a cyber security emergency plan that includes all assets, including those used by systems that govern machines and plants in production: it can improve resilience and demonstrate to collaborators, customers and investors the commitment to business continuity and ultimately increase the value of the Company itself.

Industrial Cyber ​​Security