Identity Challenges in Manufacturing - Tammy Klotz - CSP #202

This podcast discusses identity security challenges specific to the manufacturing industry, highlighting the differences between IT and operational technology (OT) security. It explores the unique needs of frontline workers, the importance of physical security, and the complexities of implementing role-based access control, emphasizing the critical need for collaboration between security and operational teams to ensure safety and prevent potential harm.

IT vs. OT Security

• 00:03:32 Operational technology (OT) in manufacturing prioritizes availability over confidentiality, unlike traditional IT security. Patching is done during planned outages, requiring a different approach to security controls and risk management. The repercussions of a security breach in manufacturing can be severe, potentially leading to loss of life, emphasizing the critical importance of robust security measures.

Frontline Worker Identity

• 00:07:55 Frontline workers often face challenges with traditional identity controls like MFA due to their work environment and the types of devices they use. Alternative authentication methods, such as biometric technologies and physical tokens, are more suitable in these situations. Maintaining strong identity controls while accommodating the unique needs of frontline workers requires a creative and flexible approach to security.

Physical Security

• 00:13:16 In manufacturing, physical security is the first line of defense, especially for critical infrastructure organizations. Access to facilities and equipment must be carefully controlled and monitored, as unauthorized access can lead to significant harm. The Oldsmar water treatment plant breach serves as a compelling example of how physical security failures can impact the safety and well-being of communities, highlighting the importance of taking physical security seriously.

Role-Based Access Control

• 00:16:44 Implementing effective role-based access control (RBAC) is a significant challenge, particularly in complex environments like manufacturing and SAP systems. Defining clear roles and responsibilities for access is critical, but often difficult due to complex business processes and the need for collaboration between security teams and business stakeholders. Ensuring timely access removal when employees leave the organization is also a vital component of maintaining a robust RBAC system.

Manufacturing Device Security

• 00:23:35 Various technologies, including barcode scanners, sensors, cameras, and control room systems, are used in manufacturing environments. Securing these devices and controlling access to their data is crucial. Each device and system must be considered from a security perspective, and appropriate controls must be in place to prevent unauthorized access and ensure the integrity of the data collected. This includes monitoring for anomalies and implementing security measures that address the specific risks associated with each technology.