A new approach to unlocking Cybersecurity within Operational Technology

In the past, management's attempts to engage employees in cybersecurity awareness have often encountered challenges. Nowhere is this more evident than in the operational realms of the Process, Utilities, and Manufacturing industries. The unique work practices and culture among field, plant, factory, and engineering workers necessitate personalized learning approaches distinct from those of office-based staff.

Over the past 18 months, I've delved into discussions with industry analysts and customers to address a critical question: How do we ensure the online safety of our operational teams while safeguarding our legacy-laden operational technology?

The answer, I've discovered, is not simple. This sector grapples with a complex challenge, compounded by its responsibility for critical infrastructure. Today, I aim to share the insights, ideas, and strategies that have emerged from these discussions.

Allow me to begin with a pivotal realization: Operational, Field, Factory, Plant, and Engineering staff have already undergone a significant culture shift over the past five decades. This transformation is encapsulated in the principles of "Zero Harm" or "Safety First."        

While cybersecurity threats may be relatively new and less intuitive to this audience, reframing cybersecurity as "Cybersafety" and aligning it with the ethos of safety-first initiatives can yield profound success.

Resonating with an operational and engineering audience

Here are three strategies to reframe cybersecurity and effectively communicate with operations employees in a language they resonate with:

1. Alignment with Existing Safety Culture: The process, utilities and manufacturing industries have a robust culture of safety, exemplified by initiatives such as "zero harm" and "safety first." This pervasive emphasis on safety promotes a mindset of vigilance and proactive risk mitigation among employees. By framing cyber security education as cyber safety, it seamlessly integrates into this culture of safety consciousness. Employees understand that just as they prioritize safety measures to prevent physical harm, maintaining cyber safety is crucial for protecting digital assets and operational continuity. This alignment reinforces the notion that cyber security is not an isolated concern but rather an essential aspect of overall workplace safety.

2. Consistent, Constant, and Omnipresent Promotion of Safety: Safety promotion in the process, utilities and manufacturing industries is characterized by its consistent, constant, and omnipresent nature. Safety messages, reminders, and training modules are integrated into daily operations, ensuring that safety remains at the forefront of employees' minds. By extending this approach to cyber safety, organizations can effectively promote awareness and adherence to cyber security best practices. For example, incorporating cyber safety reminders into pre-shift safety briefings, displaying cyber security posters in control rooms, and integrating cyber safety modules into ongoing training programs can reinforce the importance of cyber security in the same manner as physical safety. This consistent and pervasive promotion of cyber safety ensures that employees recognize its significance and are motivated to adopt secure behaviors in their daily work routines.

3. Behavioral Change through Positive Messaging: Safety initiatives in the process, utilities and manufacturing industries have successfully instilled a culture of vigilance and proactive risk mitigation by emphasizing positive messaging and tangible benefits. Similarly, framing cyber security as cyber safety focuses on the positive outcomes of adopting secure behaviors rather than instilling fear or emphasizing punitive measures for non-compliance. For instance, highlighting success stories of employees who prevented cyberattacks through their vigilance or showcasing the benefits of protecting sensitive data can inspire others to embrace cyber safety practices. This positive reinforcement fosters a culture where employees feel empowered to contribute to the overall security posture of the organization.

Summary

In conclusion, as we navigate the increasingly complex landscape of cybersecurity in the Process, Utilities, and Manufacturing industries, it's crucial to recognize the unique challenges faced by operational teams. By acknowledging the successful cultural shifts achieved through initiatives like "Zero Harm" and "Safety First," we can leverage existing frameworks to enhance cybersecurity awareness and practices.

Through my conversations with professionals in these industries, it's evident that there's a growing recognition of the value in extending safety management messaging to encompass cybersecurity. However, the real challenge lies in the accessibility and effectiveness of the available training courses and educational mechanisms.

Currently, much of the cybersecurity education content on the market is tailored towards office environments or crafted by individuals with little understanding of the unique dynamics of factory floors or field operations. Moreover, the delivery mechanisms often assume easy access to computers, which may not always be the case for operations and engineering staff. As such, there's a pressing need to explore alternative communication methods to effectively reach this audience.

Feel free to comment if you would like to contribute to this fascinating topic. I have been impressed by the variety of initiatives the industry has adopted to try and address these risks and I would love to hear about any new approach you might have tried that could help others with this type of risk remediation.

#OperationsTechnology #Cybersecurity #ZeroHarm #Process #Utilities #Manufacturing #ProjectDirector #EPC