Podcast: Cybersecurity best practices every manufacturer needs in 2025

Rob Larsen is a security advisor for the cybersecurity firm SilverFort. As a former chief security architect for General Motors, Rob is intimately familiar with cybersecurity from a manufacturing point of view. Rob recently spoke with Dennis Scimeca, senior editor for technology at IndustryWeek, about why manufacturers are being targeted by hackers, and how companies can implement basic cybersecurity protections. 

Below is an excerpt from the podcast:

IW: Manufacturers are one of the most popular targets for ransomware attacks. Whenever I get a report on cybersecurity, ransomware is at the very top, by which we mean when threat actors, hackers, bad guys will either encrypt or capture a company's data and then request payment before unlocking or returning the data. And if that incident, that breach, pauses the production line, the amount of lost revenue from not being able to produce has inspired manufacturers to go ahead and quietly pay the ransomware demand to get their data back or to unfreeze their operations. So, ransomware is something that manufacturers really need to be prepared for. Rob, are there other recurring attack types that manufacturers specifically when setting up their cybersecurity measures really need to prepare for?

RL: For manufacturing, ransomware has been a real big threat, But manufacturing environments suffer from supply chain attacks. If they have intellectual property inside the manufacturing facility, those intellectual properties could be stolen. Phishing attacks, equipment sabotage, manufacturing data leakage and breaches, nation state attacks, all sorts of attacks are, I would argue, not specific just to manufacturing. These attacks are starting to go from both enterprise into manufacturing. And what that means is that more and more manufacturing needs some of the protection that the enterprise has been deploying for several years.

IW: As manufacturers are deploying connected worker systems, tablets, for example, do manufacturers need to put specific effort into OT or does good cybersecurity hygiene naturally cover that territory or does it need to be a separate, concerted vein of thought around OT?

RL: I really believe that when you're tackling the manufacturing cybersecurity problem, you really have to design a security strategy that fits that manufacturing facility and what that manufacturing facility is producing. However, the same principles that you use on the enterprise can be applied in the manufacturing facility. You just may go about the security strategy differently. 

And that's, I think, the difference between the enterprise and manufacturing. They have different systems in the data center for the enterprise than they do on the plant floor. And you do have to craft a strategy that makes sense for the devices and for the production style of that company. But the principles can be the same. You need to know the devices that are in that manufacturing facility. You really need to know how you are deploying your identity management strategy. Is it centralized to AD, or are they a bunch of local accounts? You need to figure out what your remote access strategy is. You need to understand what intellectual property might exist inside that manufacturing facility.

You need to understand how the systems inside that manufacturing facility call out or call home. Is it cellular? Do they traffic through the path through the manufacturing out through a corporate proxy? All these sorts of things that the enterprise has been looking at for years, the manufacturing folks now need to look at it from a pure manufacturing cybersecurity perspective. And that's a really healthy approach because I think if you do that, you can take things that the enterprise has already used and deployed and use it inside the manufacturing facility. It's just an extension of some of the capabilities in the enterprise applied to manufacturing, but maybe the policies are different. But some of the products are the same.

IW: Some of the most common advice IndustryWeek receives from cybersecurity experts to pass along to our readers is the importance of training and awareness. It kind of touches upon the previous question talking about OT and people on the plant floor. Is that accurate?