Today it controls the protective equipment needed before entering a building site, the time professional drivers may spend behind the wheel, and even how long someone can stare at a computer screen.
Within a factory, someone will be responsible for keeping track of each and every employee’s physical activity–what they’re doing, where and with what–to make sure that they’re safe.
However, even though a cyber attack could have a direct impact on safety, this activity isn’t being scrutinised. Will it take a cyber instigated workplace catastrophe for someone to make a connection between cyber security and safety?
The Health and Safety at Work Act
Prior to 1974, only the most ‘dangerous’ industries were regulated. While mandatory practices, such as the use of machine guards in factories, coupled with inspections did have some impact in reducing accidents, tens of thousands were killed and injured annually at work well into the twentieth century. The Health and Safety at Work Act changed that.
While the UK’s Health and Safety culture is often ridiculed, with its practices berated, the impact the Act has had on improving safety can’t be denied. Since 1974, Health and Safety Executive (HSE) figures show occupational deaths and injuries in the UK have decreased by over 75%. While it may be described as a ‘nanny state,’ factories, office blocks and building sites across the UK are a safer place for both those working and visiting them.
However, there is a new risk to workplace safety that is being ignored–the elephant in the room is cyber security.
Security’s Impact on Safety
Cyber risks aren’t limited to damaging a company’s reputation by losing customer data or having its intellectual property plundered. There is demonstrable evidence that a security incident could seriously endanger people’s lives. As illustration, were an employee within a food factory to ‘accidentally’ change the speed of a computer-controlled mechanical slicer, those working with the affected machine really could be dicing with death. Of course, it’s not just those within the factory that are at risk, were an attacker able to access the safety instrumented system in an oil refinery, and compromise its ability to shut down the processes in a controlled way, then many people’s lives could be at risk, not to mention the risk to the environment. Similarly, if a hacker were to take control of a purification process in a water plant, an entire water supply could be made unfit to drink.
While the above scenarios remain theoretical, there is evidence of hackers gaining access to critical processes to cause damage. The most infamous incident dates back to 2010 when inspectors, visiting the Natanz uranium enrichment plant in Iran, identified an issue with its centrifuges. While the issue wasn’t immediately identified, it was eventually traced back to a malware infection dubbed Stuxnet. This malicious computer program escaped the digital realm to manipulate motors that eventually caused physical damage to the centrifuges. The world’s first digital weapon wasn’t unleashed to put lives at risk, but that doesn’t mean we can be complacent.
Attitudes must change so that cyber security risks are viewed as being just as important, and interlinked with, considerations about physical safety.
Addressing the Elephant
Just as health and safety necessitates effort from everyone to maintain an unblemished safety record, addressing cyber security risks will also require a combination of legislation, cultural change and employee awareness.
The UK government’s recent proposals to implement the EU’s Network and Information Systems (NIS) Directive is one such positive step, by forcing operators of essential services to put a determined cyber security strategy in place, or risk financial penalties. The threat of being hit with a fine of up to £17 million, or 4% of global turnover, will undoubtedly focus people’s minds and help to make this a board-level issue.
However, to really effect change on the ground will require a vastly improved level of cyber security awareness. Employees need to be trained so that they understand what are safe behaviours, in terms of cyber security, and how to avoid taking unnecessary risks. Hackers prey on individuals in positions of trust within these environments as all too often they’re proven as a weak link in an organisation’s cyber defence. Cyber security training can dramatically reduce the chances of commonly-used techniques, like spear phishing attacks or social engineering methods, being successful. For example, if employees understood the cyber security risks of a site manager plugging in a personally owned iPad while performing diagnostic checks, they may be willing to challenge rule breakers in the same way they would if someone was handling a piece of equipment in an unsafe manner.
To bring this health and safety approach into context, organisations should follow three key principles:
- Firstly, employees need to understand how their activity can introduce cyber risks and the implications from this behaviour.
- Secondly, clear cyber security policies need to be set and reviewed regularly to ensure risks are addressed and threats minimised.
- Finally, risk assessments need to be conducted regularly, to ensure existing risks are being properly managed and any new risks identified and mitigated successfully.
Hopefully it won’t take a chemical plant explosion, mass water contamination, or worse to drive home the vital importance of cyber security awareness within factories, power plants and critical infrastructure. It’s time to address the elephant in the room.
The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.
