Meeting the Threat in 2019: Cybersecurity for Pharmaceutical and Biotechnology Firms
_reg.jpg)
By Megan Berkowitz
In 2017, Merck, a pharmaceutical company, was one of many companies targeted by a ransomware attack, known as “WannaCry.” Reuters reported that this attack “disrupted production of some Merck medicines and vaccines,” at a high cost for the company.[1] In addition, work was disrupted for a huge number of the company’s employees, many of whom rely on computers for the vast majority of their work.[2]
The WannaCry ransomware attack that successfully targeted Merck is not the only cyberattack to which the pharmaceutical industry has fallen victim. As pharmaceutical and biotechnology companies move toward greater digitalization and the storage of more valuable data, their digital security practices become more and more critical. Many such manufacturing facilities rely on Internet of Things-connected technology in order to automate their very precise, sensitive manufacturing processes. This connectivity makes the facilities more susceptible to attack by dramatically increasing the number of internet-connected endpoints that must be protected. Additionally, the proprietary information behind drugs and other biopharmaceutical advances are valuable, and thus a prime target for cyberattackers. Finally, with the extremely sensitive nature of data collected and used by pharmaceutical and biotechnology companies, security measures are particularly important for these firms, especially those looking to gain and keep trust with consumers and patients.
As a result, cybersecurity has become an essential part of doing business in the biopharmaceutical industry. Across the industry firms are stepping up their game when it comes to cybersecurity. These companies are deploying more and more resources towards cutting-edge technologies like machine learning, artificial intelligence, and orchestration.
An important question to consider, though, is to what strategic ends are these cutting-edge technologies being put. Are they simply bolstering traditional methods of cybersecurity, or are they being used for methods of cybersecurity that are new and innovative, instead of simply faster or more efficient versions of the same product?
The Incident Response Approach to Cybersecurity
Traditional cybersecurity approaches are focused on reporting about intrusions after the fact, in what is known as an “incident response.” What this means is that an adversary – commonly referred to as a “hacker” – finds some way to gain access to a target and compromises it. The target can be accessed through vulnerabilities in web frameworks, internet browsers, or internet infrastructure such as routers and modems. Regardless of how they gain access, once an attacker is discovered, the forensics about the attack, including basic information known as Indicators of Compromise (IOCs) like IP addresses, domain names, or malware hashes, are shared across the cybersecurity community. These IOCs are then used broadly to thwart future attacks.
The problems with this approach are twofold: like a canary in a coalmine, someone has to be a victim first so that IOCs can be derived and shared with others; additionally, blocking IOCs has a very short half-life. Most adversaries subscribe to the very feeds that companies subscribe to in order to quickly learn if they have been exposed. All an adversary has to do is come from a new IP address or recompile their malware so that it has a new hash value (both of which are extremely trivial) and their attacks will sail through defenses that depend on IOCs. This after-the-fact methodology consumes a lot of resources and generates a lot of seemingly valuable metrics, but it is ultimately flawed.
Cybersecurity teams and adversaries are trapped in an endless loop where the adversary always has the advantage. As hackers repeatedly gain access to valuable systems and data using the same methods, cybersecurity teams continue to chase after them to secure compromised systems. While a great deal of effort is put towards understanding as much as possible about the adversary and his methods, only a small amount of that understanding is used, and only to perform the very basic actions described above. Adversaries continue to play chess, strategizing about how to slip past cybersecurity teams unnoticed, while those same teams act as though the game is more like tic-tac-toe. Very little cybersecurity effort is put towards addressing the methods used by adversaries; instead, security teams are locked in a pattern of waiting for inevitable attacks, trying to minimize the damage they cause, ensuring that remediation occurs as quickly as possible, and blocking only exactly identical attacks.
Planning for the Future of Cybersecurity
As is readily apparent, these current, standard methods of cybersecurity are fundamentally flawed. Incident response only helps prevent attacks that exactly replicate past ones. To stem the flow of cyberattacks and to truly protect against them, the cybersecurity industry needs to embrace a paradigm shift. Rather than rely solely on the incident response and recovery methods that have been used for many years, a more proactive, sophisticated approach is needed. It will need to be designed to successfully recognize adversary methodology (and all the manners in which an adversary attempts to obfuscate their methodology) before attacks occur and at a meaningful scale. This kind of approach, when paired with incident response tactics, could provide true security to vulnerable, critical networks.
If the cybersecurity world wants to halt dangerous, costly attacks, there is a great need to shift attention towards prevention. Instead of seeking discrete, static IoCs based solely on what has already occurred, proactive cybersecurity analysts can instead use the intelligence they have derived about adversaries’ methodologies – commonly referred to as tactics, techniques, and procedures (TTP). From these TTPs, analysts can identify the general form and components of an adversary campaign. In addition, they can determine abstract indicators like how the adversary is attempting to hide his actions. A proactive cybersecurity tool would be able to recognize possible adversary TTPs and indicators that describe a threat (or threatening behavior) in general terms. The system would then act on any traffic which met this pattern before it reaches inside a network, as the attack occurs, and do so in a way invisible to adversaries. Using this basic model, a cybersecurity tool could truly prevent common exploits before they were executed, and could even predict and protect against future, not yet seen exploits. In addition, this prevention plus response method of cybersecurity enables teams to truly take advantage of new, cutting-edge technologies in ways that change the game, instead of simply adding speed (and cost).
A TTP-based cybersecurity tool would work in concert with existing incident response, internally-focused cybersecurity efforts, adding a layer of prevention over the top of this vital but flawed process.
With these two methods employed hand-in-hand, cybersecurity teams can make headway in reducing the number of attacks, and can more quickly and productively respond to attacks that do prove effective.
About the Author
Megan Berkowitz is a writer and researcher based in the United States. She holds a Bachelor of Science in Biology and English from Tufts University.
[1] https://www.reuters.com/article/us-merck-co-cyber-insurance/merck-cyber-attack-may-cost-insurers-275-million-verisks-pcs-idUSKBN1CO2NP
[2] https://www.washingtonpost.com/news/the-switch/wp/2017/06/27/pharmaceutical-giant-rocked-by-ransomware-attack/?noredirect=on&utm_term=.84aac5fa42ae

Check out our free e-newsletters
to read more great articles.
- Posted in:
- Article
- Related Portals:
- Plant & Asset Management, Manufacturing Operations Management, Cybersecurity, Process Instruments, Field Devices & IO, Process Safety, Process Automation, Chemical, Pharmaceutical
MORE ARTICLES
-
Augmented Intelligence
By Mark Howard, EU Automation
Augmented intelligence is one of the few technologies named on the Gartner Hype Cycle for Emerging Technologies,... -
PLC Programming Preference Survey: Insights & User Comments
By Bill Lydon, Automation.com
The PLCopen organization and Automation.com conducted a joint survey of PLC programming preferences. Here are some... -
Robots or Cobots: Which to Choose?
By Jonathan Wilkins, EU Automation
Today’s plant managers are faced with a dearth of automation technologies but it’s not always obvious what... -
A Closer Look at Composites
By Robert Glass, Exel Composites
Composites have transformed the technologies of many industries —although the materials used to manufacture... -
How AI is Disrupting the Oil and Gas Industry
By Ripal Vyas, Softweb Solutions
The arrival of new technologies like artificial intelligence (AI) and machine learning (ML) is transforming the...
RELATED
-
Seeq announces achievement of Amazon Web Services (AWS) Industrial Software Competency status
To receive the AWS Industrial Software Competency designation, APN Partners undergo rigorous AWS technical validation related to industry specific...
-
Pepperl+Fuchs Comtrol and Callisto Integration announce strategic partnership
Pepperl+Fuchs Comtrol and Callisto work with each manufacturing customer to deliver initial solutions that have tangible results, and then collect...
-
Arena Solutions announces strategic partnership with PRG
This deepened strategic partnership expands PRG’s services for Arena customers that desire assistance or simply have limited internal resources....
-
Tenable announces acquisition of Indegy
The Indegy Industrial Cybersecurity Suite integration with Tenable.sc, for on-prem vulnerability management, is available today. The Indegy...
-
KraftPowercon Sweden announces acquisition of Marsulex Environmental Technologies Corporation
The acquisition will enable MET to introduce electrical upgrades of Electrostatic Precipitators (ESPs) using KraftPowercon’s technology...