Spend any length of time in any particular industry and you’ll hear the same statements being made that purport to be ‘facts.’ Dig just below the surface however, and you often find out that when it comes to the security of Defense Industrial Base (DIB) these statements are more myth and legend than fact. As the National Center for Cybersecurity in Manufacturing, we felt it was important that decisions related to cybersecurity in the DIB should be based on hard data, not fairy tales.
To that end, MxD and its partner QuestionPro recently conducted a detailed study of 700 cybersecurity decision-makers in small and medium-sized manufacturing operations across the United States. These are businesses with anywhere from 2 to 499 employees who make the parts and components that go into platforms and systems. The headline number from this research should keep every business owner, procurement official, policy- and lawmaker awake at night: 68% of these businesses suffered a real, disruptive cyber incident during the previous 24 months. [CHART – Cybersecurity Incidents – Slide 13]
Let that sink in for a moment. Out of 700 surveyed firms, 479 of them experienced an attack that overcame their defenses and had a negative impact on operations. These are not theoretical vulnerabilities or a warning about a hypothetical future threat: it is a running tally of ongoing damage. Cybersecurity in manufacturing isn’t something that’s nice to have, it’s essential to the survival of individual firms, and the integrity and viability of the American manufacturing supply chain.
"There is a mindset [in company leadership] of ‘we are too small to be a target,’ which is our biggest vulnerability.”
The impacts of these incidents are not trivial inconveniences. Over 25% of the firms that suffered an attack reported operational downtime; their machines stopped running and their workers stood idle. Nearly 20% experienced direct financial losses. In a tight-margin manufacturing shop running three shifts to deliver parts on a defense contract, a week of unplanned downtime can destroy any hope of profitability. It also delays deliveries to prime contractors, which has cascading effects on military readiness and lethality. [CHART – Incident Impacts – Slide 13]
So much for the known-knowns: what about the known-unknowns? When the survey asked manufacturers about close calls and near misses, 57% of respondents said they either had no incidents or were unsure if they had been targeted. In our experience, when a small business says they are unsure if they have been targeted, it almost always means they lack the ability to see the intruders inside their network. If you think that’s mere speculation, note that the remaining 43% of firms who did have visibility into their networks reported a constant barrage of credential-based attacks, phishing scams, and unauthorized entry attempts. [CHART – Narrowly Avoided Incidents – Slide 14]
Convergence and Risk
Over the last decade, Industry 4.0 trends have driven a massive push to connect manufacturing equipment to internet-facing office networks. The survey shows that more than 70% of small and medium manufacturers have fully or partially linked their office IT networks directly to their factory floor operational technology. They want the convenience of seeing real-time production metrics and monitoring inventory levels from a desk. [CHART – Integration Level – Slide 9]
For all the benefits IT and OT convergence brings, it also increases a company’s attack surface. An air-gapped lathe cannot be hacked from a laptop half-way across the world. Today, if a receptionist on the corporate network clicks on a malicious link in an email, malware can travel all the way through to the assembly line. This is exactly what happened to a manufacturer in the $1 million to $4.9 million revenue bracket, who reported that an employee opened a deceptive email containing a virus, requiring the immediate intervention of their IT team to halt its spread before it corrupted the production environment.
Combating these threats requires skill, but nearly 50% of the surveyed firms operate with two or fewer employees dedicated to cybersecurity and compliance. You cannot effectively defend a converged environment with an overworked IT generalist learning cybersecurity on-the-job, and a computer-savvy technician who gets seconded to fix printer jams and reset passwords when they’re not making parts. The situation gets even worse when you look at the smallest operations. For manufacturers bringing in under $1 million in annual revenue, 16% run their entire business without anyone with cybersecurity skills or responsibilities. [CHART – Dedicated Employees – Slide 9]
This resource crunch highlights what the IT security world calls the “cybersecurity poverty line.” It’s not that small manufacturers don’t care, they simply do not have the resources to manage the constant drumbeat of software updates and security alerts. They are trying to get product out the door, so security takes a back seat until something stops working.
Dissecting the Threat Landscape
and Supplier Blind Spots
Social engineering remains the most common entry point to victim systems. Email-based attacks, phishing, and spam made up 13% of the reported near misses. Hackers know that the easiest way into a system is to trick a human being into handing over their credentials. One respondent running a shop with under $1 million in revenue described receiving a flood of urgent emails from an entity pretending to be an established supplier demanding immediate payment. The owner only avoided a major financial loss because they took the extra step to manually check the website and discovered the domain was fraudulent. [CHART – Recent Experiences – Slide 13]
Direct system attacks are the next major threat vector. Rogue login attempts and unauthorized access efforts accounted for 9% of close calls, while ransomware and malware tracked at another 9%. These are not amateurs but organized and skilled threat actors, some aligned with adversary foreign governments. 19% percent of the defense, aerospace, and small-arms manufacturers surveyed explicitly selected nation-state espionage as a primary threat to their operations.
Despite operating in a high threat environment, the DIB has a blind spot regarding its own supply chain. The survey revealed that defense, aerospace, and small-arms manufacturers are actually less likely to perform rigorous cybersecurity audits or reviews of their own sub-tier suppliers than companies operating in civilian commercial sectors. [CHART – Cybersecurity Assessment – Slide 21]
Contractors assume that because their supplier has cage code, or has done defense work before, that someone must have verified their security. That’s a mistake. If you do not audit your subs or otherwise confirm the adequacy of their cybersecurity efforts, you are essentially leaving doors unlocked in a dangerous neighborhood.
The Compliance Complexity Wall
When policymakers see statistics about poor cybersecurity, their immediate response is usually to draft a new regulation or demand stricter compliance. That impulse is driving the adoption of the Cybersecurity Maturity Model Certification. The survey data indicates that this approach is fundamentally misaligned with reality on the ground. When you look at what stops a small shop from pursuing CMMC compliance, the number one barrier across the board is not the cost but the complication.
"The paperwork is a full-time job we didn't hire anyone for."
[CHART – Main Barrier to Compliance – Slide 20]
Regulatory language is a foreign dialect to a small business owner, who does not have a legal team or a compliance department to decipher hundreds of pages of federal requirements. They are hit with a wall of jargon about “cryptography” and “sanitization” and “information integrity.” They don’t speak the language, so they don’t know where to start, so they resist acting. [CHART – CMMC Familiarity – Slide 20]
The data exposes a massive internal knowledge gap regarding these regulations. While 70% of Chief Information Security Officers at surveyed manufacturers claim to have expert or deep knowledge of CMMC, only 30% of actual Compliance Officers say the same. The divide gets wider when you look at company revenue. At manufacturers making over $100 million annually, familiarity with CMMC sits at over 70%. For shops pulling in under $1 million, that familiarity plunges to just 23%. The regulatory burden is universal and uniform, but the resources to handle it tends to scale with revenue. A multi-billion-dollar prime defense contractor can easily hire a team of compliance experts and cybersecurity professionals to manage their CMMC effort. A family-owned machine shop with $2 million in revenue faces the same threats but lacks the resources necessary to move forward. If we expect small, specialized shops to climb the same compliance hill without assistance, they will simply walk away from defense work, and the DIB will be weaker for it.
The Culture of Inertia and the Catalyst of Pain
The true barrier to securing our defense supply chain is deeply cultural. The survey points out that IT and cybersecurity are almost universally viewed as cost centers by company leadership. A new five-axis milling machine might cost $250,000, but an owner can see it, touch it, and calculate exactly how many parts it will produce per hour to pay for itself. A $50,000 upgrade to firewalls and endpoint detection feels like burning money since the solution and benefits are intangible.
"Management looks at the ROI of a new lathe, but they can't see the ROI of a firewall until they get hit."
Proactive urgency is rare in manufacturing environments. Owners do not invest in security because it is the right thing to do; they invest because they have been hurt. The survey indicates that pain is the ultimate catalyst for behavioral change. After an organization experiences a successful breach, 86% of manufacturing executives report a shift in how they view security spending. Thirty percent of these companies directly increase their cybersecurity budgets immediately following an incident. Another 10% shift their entire corporate posture from passive defense to proactive threat hunting. They suddenly approve the budgets for 24/7 network monitoring, advanced security technology, and third-party penetration testing. The budget was never the true constraint. The money was always there; what was missing was the leadership urgency to spend it. [CHART – Qualitative Summary Incident Response – Slide 17]
Relying on a breach to trigger security investments is a dangerous strategy. By the time a need is identified, options evaluated, solutions selected, contracts negotiated, and installation and configuration completed, months could go by; months during which more disruptive attacks and exfiltration of proprietary information could take place. We need to find ways to foster that same level of executive urgency before the disaster occurs, without drowning firms in a regulatory morass.
Recommendations
If we want to protect the DIB without driving away our smaller, innovative manufacturers, we have to change our approach to improving security and compliance with standards. We need to adopt practical approaches that fit the realities of industrial environments.
First, we must make it abundantly clear, without hyperbole, that manufacturers of all sizes are at risk. The threat is real, it is persistent, and it causes real pain. Regular reporting using authoritative sources highlighting factors that resonate with manufacturers will help keep this issue top of mind and inform the thinking of company decision-makers.
Next, we need to get more and better cybersecurity technology into as many DIB companies as possible. Not just to stop active attacks, but to provide intelligence that will shed light on the nature and volume of threats. There are too few companies sharing too little information for us to know with confidence if the numbers we’re looking at are reflective of reality (or much worse).
Third, it is imperative that we get more cybersecurity expertise onto the rolls of manufacturers and elevate the skills of those who are already there. Small and mid-sized manufacturers in particular are not going to attract the best talent by treating security as an extra duty or something you’re doing begrudgingly. Owners should hire as if they take the risks associated with insecurity seriously.
If you’re in the DIB you’re in a supply chain. All links in that chain need to be as strong as possible. Large primes have the resources necessary to be strong, and they push security requirements down to subs to ensure that, while they might not be on par, they’re not weak. It is incumbent upon you to make sure that everyone you deal with meets appropriate requirements in order to avoid a compromise that cascades through the supply chain.
Whether we’re dealing with CMMC, ITAR, or any other compliance regime, an effort needs to be made to reduce complexity and increase understanding of these technical and often esoteric issues. We need to provide DIB companies with regulations, policies, templates, and guidance in plain English as per the Plain Writing Act of 2010.
"It feels like it’s written in a different language. We need a 'CMMC for Dummies'."
Service providers and product designers need to remember when they are designing solutions for this market, that they should not take it for granted that they will be dealing with someone who has a long and extensive background in security and who has access to the most current technology. Being the security person is probably not even their first much less full-time job, and they are likely to be using dated hardware, software that’s well past its shelf-life, and devices that use protocols you’ve never heard of.
Finally, we must change how we train the manufacturing workforce to deal with cybersecurity issues. Sending shop floor workers to sit through slide presentations designed for office workers does not develop the awareness and skills needed to respond to cyber threats. Hands-on, practical training designed specifically for operational technology and factory environments should be de rigueur. The more security becomes integrated with operations, the sooner security starts being a part of the day-to-day, which is exactly what is needed in an environment that is perpetually contested.
Rethinking DIB Security Policy
For lawmakers and defense officials the lessons from this survey should drive a shift in policy strategy. To date the approach has been to make security the manufacturer’s problem alone. We write clauses into contracts, demand third-party assessments, attestations, and threaten to deny work or impose penalties if a supplier falls short. While suppliers should bear some of the security burden, the data shows that this heavy-handed approach is not accomplishing the desired goals of both a more secure and more technically diverse industrial base. If we continue down the road of unassisted, top-down, unfunded mandates, we will accelerate the hollowing-out of the DIB. The small, innovative firms that develop specialized components and novel solutions will simply exit the defense market.
We should consider treating the cybersecurity of our suppliers as a shared national security infrastructure project. Just as the government helps fund manufacturing institutes or protects critical physical trade corridors, we must actively subsidize the digital defense of our supply chain. That means funding, tax incentives, or offsetting some of the cost of security efforts and creating shared resource pools where small firms can team up with peers or primes to lower their technical defense costs and access to expertise.
It is also worth considering whether or not it makes sense to scrap the standard compliance playbook and come up with something more likely to produce tangible results. Compliance is the “basement” as far as steps required to secure an enterprise, and compliant companies get hacked all the time. Mandating compliance with regulations is “what we know how to do,” not necessary what will work. Our adversaries are not following a rigid framework and they’re working at combat speed. If we’re serious about defending our defense supply chain, shouldn’t we be thinking of ways to detect and respond in real time and at scale? If defense appears to be a sub-optimal approach, then what about shifting our efforts to improving resilience to attack so that adversary action is temporary but our ability to support warfighters remains perpetual?
The small and mid-sized manufacturers across America want to continue to play their role in national defense. But they are trapped between sophisticated adversaries who have them outgunned, a complex federal compliance regime they cannot understand, standards they cannot afford to meet, and talent they cannot afford to hire. If we want to produce the weapons and munitions that will enable battlefield superiority tomorrow, we have to help secure the factory floors of today with knowledge and resources that will make a difference, not merely following familiar courses of action.
