We live in a connected world.
The Internet of Things (IoT), the ubiquity of data and the Fourth Industrial Revolution deliver gains in productivity and efficiency through connections across the manufacturing sector.
Yet the same connections that strengthen us could also weaken us: as our shared data becomes more powerful it could prove to be our Achilles heel.
And it’s the weak link in the chain that hackers are increasingly keen to exploit.
The importance of security for electronic manufacturing
Recent concerns have highlighted how security threats could derail the application and uptake of IoT.
A study released by Hewlett-Packard discovered that 70% of the most commonly used IoT devices contain at least some vulnerabilities.
A review of these breaches led a contributor to New Electronics to bemoan that ‘vendors are repeatedly failing to apply simple security best practise and are exposing their customers to attack.’
The article goes on to list ten common security breaches, among which it includes issues with the hardware itself.
- Unnecessary functions such as debug ports are left in place creating potential routes in for hackers.
- Devices are under-utilising security mechanisms such as BGA (Ball Grid Array) packages which, when combined with good PCB design, make it harder to tap into signals.
But these concerns about security are not just about the end-products but can be found in the manufacturing process itself.
Here are some of the stories that have hit the headlines in the last few years:
- Electronics manufacturer Foxconn was breached by a hacktivist group that released every employee’s login information.
- Boeing was compromised repeatedly for four years by foreign nationalists trying to steal defence program manufacturing plans.
- In Japan, Korea and Germany manufacturers have been targeted by hackers, believed to be from China, trying to access IP data, trade secrets and blueprints.
And here’s a story that did not make quite such a big splash but is even more alarming.
- 48% of UK manufacturers have been subject to a cyber-attack – and half of these businesses suffered either financial loss or disruption to business as a result.
- Manufacturing is now the third-most targeted sector for attacks by hackers.
These shocking statistics are from a report on cyber-security for manufacturers, published by EEF and AIG and carried out by the Royal United Services Institute (RUSI).
It goes on to suggest that this threat will only deepen with increasing digitisation – and notes that 91% of manufacturers are investing in digital technologies.
The report also found that across the manufacturing sector cyber security maturity levels are ‘highly varied’ both in terms of awareness of the cyber security challenge and the implementation of appropriate risk mitigation measures.
Which suggests there are many weak links in the supply chain out there.
Critical questions to ask your EMS provider
The good news for electronic manufacturers is that GDPR has helped to focus minds. Manufacturers are increasingly willing to question their suppliers to ensure adequate security procedures are in place.
The EFF/AIG report found that 58% of manufacturers have been asked to demonstrate or guarantee the robustness of their cyber-security processes by a business within their own supply chain.
Worryingly, 42% haven’t.
And of even more concern is that 37% of manufacturers admitted they would be unable to do this if asked today.
If you are looking for an EMS provider to partner with here are four critical questions you should ask about their security arrangements.
(We’ve provided our own answers after each one.)
1/ How do you ensure the security of your customer’s product data?
- Our data is stored in a protected area that has restricted access.
- Data is only ever distributed on a need to know basis.
- Our network has strict access controls, with verification required at each level of security.
- We do not outsource any area of your PCB assembly – to ensure there is no risk of compromise from this.
- We manage our supply chain robustly, establishing long-term relationships and always ensuring Non-Disclosure Agreements are in place where needed.
2/ How do you ensure security on-site?
- Our site has controlled access – this extends to each facility and internal area.
- We carefully manage any contractors on site – access to customer data is never granted to anyone not employed by Chemigraphic.
- The data itself is stored in a vault storage.
- We have access-controlled IT server rooms.
3/ How do you manage your supply chain to ensure data security?
- As the outsourced manufacturing partner to our customers, we take full responsibility for the entire manufacturing process and the management of any suppliers and materials within it.
- We source excellent materials using only reputable partners.
- We have enhanced inspection and qualification procedures for new parts to minimise the risk of counterfeit parts with security feature defects or malicious designs.
- We undertake supplier site security audits if necessary – especially for overseas suppliers.
- All employees and contractors are thoroughly screened.
- If you prefer, we can work only from UK sources.
- We discretely manage customer information, including the restriction of signage and non-publicity clauses etc.
- We offer segregated materials storage and build areas – and we can provide a dedicated restricted-access area for security-conscious customers.
4/ Can you show me an example of a project of yours that had high security requirements?
Sure.
This case study of our work with a cyber-security sector customer is just one example of a project we’ve delivered where customer data and through processes were highly important.
Ask us about your data’s security with us
Everything we do is governed by robust processes. These are designed to meet exacting standards of security while delivering optimal efficiency and consistently excellent results.
We believe that through intelligent planning, proper process and strict control, anything can be achieved.
If you’d like to know more about how we ensure your data is safe and secure with us, don’t hesitate to ask or take a look at why we stand out from the crowd.