ProjectX: Steel Product Manufacturer Prioritizes Employee Buy-In to Strengthen OT Cybersecurity Program

Steel Product Manufacturer Prioritizes Employee Buy-In to Strengthen OT Cybersecurity Program

A GrayMatter client builds a culture of security by earning buy-in from company leaders and plant-floor operators.

“Cybersecurity is a team sport.”

FOR THIS STEEL PRODUCT MANUFACTURER, 
CYBER IS A TEAM SPORT.

It’s important for everyone to understand not only why cybersecurity precautions are in place, but how they enable employees to perform their jobs better and protect the steel manufacturer’s physical, revenue-generating assets.

“With the recent attacks on industrial control systems and HMIs, we’re really leaning on GrayMatter not only for their technical expertise but on the organizational, marketing and communications expertise that GrayMatter has with talking to operations,” said the director of IT, infrastructure.

Challenges

• An organizational structure made up of many autonomous divisions made it difficult to recruit a champion and implement a uniform OT cybersecurity plan until a recent reorganization at the company.
• Wake-up Call: A major ransomware incident shut down both a vendor and a supplier that are well known to the manufacturer’s employees, affecting manufacturing and crystallizing the importance of cybersecurity for operations
• The company discovered that three plant floor HMIs were attempting to reach out to malware sites because of a previously undetected configuration issue.

“If one of our sites gets taken down by a cyber attack for a week, a month or, heaven forbid, several months, that drastically affects not only our reputation but our on-time delivery metrics,”

THE SOLUTION

To build buy-in, the company’s IT Infrastructure team started an information campaign dubbed “Security Bits” to share security tips and info about thwarting ransomware to build a culture of security with employees.

The steel product manufacturer focused on how security supports its key business differentiators, which are: Safety, Quality and Customer Service. For example, on-time delivery is a key performance metric for the company when it comes to customer service, the director of IT, infastructure said.

“If one of our sites gets taken down by a cyber attack for a week, a month or, heaven forbid, several months, that drastically affects not only our reputation but our on-time delivery metrics,” he said.

The company is also working with GrayMatter to conduct a site-by-site OT cybersecurity assessment and formulate next steps for roughly 15 facilities now under one hierarchy. Changes are already underway. Everything on the plant floor now must go through firewalls – something not previously in place.

Return on Investment

Imagine the financial and reputational impact of a month-long shut down of customer order fulfillment because of a cybersecurity incident like one of the company’s vendors experienced. An event of this type at the steel product company would cost tens of millions of dollars.

This was a major factor in persuading upper management to get behind a more comprehensive approach to securing operations.

Get Started

Need to get started or brush off your organization’s industrial cyber strategy? GrayMatter can help.