Tech and Manufacturing Firms Launch Industrial Cybersecurity Group

While many cybersecurity resources exist for information technology systems at small and medium-size companies, Ms. Cappelli said, few are available to provide deep knowledge of cyber risks facing operational tech, such as electrical substations, water treatment machines and factory-floor devices.

Well-publicized attacks against large industrial firms, such as episodes in 2021 at gas transporter Colonial Pipeline Co. and meatpacker JBS USA Holdings Inc., can give smaller companies a false impression they are under the radar of hackers, Ms. Cappelli said.

“A lot of them think, ‘A hack will never happen to me,’” she said.

She cited an incident last year at a water-treatment plant in Oldsmar, Fla., in which a hacker briefly increased the amount of lye used to treat water to a dangerous level. The change was reversed before there was any harm.

Industrial companies are expected to spend more on cyber technology and services as new security requirements from the Biden administration take hold.

Global cybersecurity spending in industrial critical infrastructure sectors is expected to reach $23 billion by the end of the year and top $36 billion by 2027, according to ABI Research, which tracks technology spending.

Organizations can apply to join OT-CERT this month and its resources and workshops will be available in July, Dragos said. Founding partners are Rockwell Automation Inc., Emerson Electric Co. , the National Association of Manufacturers, and information sharing and analysis centers in the electricity, oil and gas, downstream natural gas and water sectors.

The goal of OT-CERT is to strengthen cybersecurity at organizations that can’t afford it on their own, to improve the safety of the overall industrial supply chain, said Todd Boppell, chief operating officer at the National Association of Manufacturers. About 90% of the trade group’s roughly 14,000 members are small or medium-size companies, he said.

NAM offers cyber tools but they are mainly aimed at protecting IT systems, Mr. Boppell said. Partnering with OT-CERT will let his group address a growing threat, he said, noting that “On the OT side, this is an area that a lot of people don’t understand that well. Bad guys are getting more focused on it.”

A spate of recent attacks tuned to specific machines in the electricity and medical sectors, among others, prompted the federal Cybersecurity and Infrastructure Security Agency to issue warnings about potential exploits.

Cyberattacks are increasingly targeting small and medium-size suppliers, which in turn puts their large customers at risk should malware spread or connected operations get disrupted, said Ms. Cappelli, who served as chief information security officer for six years at Rockwell Automation until April.

Additionally, ransomware and other hacks can knock suppliers offline and delay product shipments, she said.

As a result, security chiefs in recent years stepped up risk assessments of smaller business partners.

“When I was at Rockwell, our third-party risk program didn’t care about manufacturing suppliers unless they had access to our IT network. If they supply copper, who cares. But then they started getting hit with ransomware and tell you they can’t supply your product for at least a month,” she said. “I got a number of those letters.”

Write to Kim S. Nash at [email protected]