Digital technologies affecting cybersecurity at pharmaceuticals industry, Fortinet says
The pharmaceuticals industry is rapidly losing the race to secure and protect intellectual property, business continuity, and mission-critical data, security firm Fortinet said in a report. As pharmaceuticals networks increasingly depend on digital innovations to continue the important work of enhancing and saving human lives, cybersecurity issues will unfortunately also increase.
To combat the rising complexity of the pharmaceutical ecosystem and the increasing scale of cyberattacks, pharmaceutical companies need a cybersecurity solution that can protect data across connected IT and operational technology (OT) environments, without slowing down the flow of vital information, Fortinet said.
The Fortinet report, titled, ‘The 2021 State of Pharmaceuticals and Cybersecurity Report’ revealed that 98 percent of pharmaceutical firms surveyed experienced at least one intrusion, while around half of the businesses surveyed experienced between three and five intrusions in the last year. The common types of intrusions detected were mobile security breaches at 40 percent, phishing at 37 percent, hacked removable storage device/media at 36 percent, and hackers including SQL, zero-day, and man-in-the-middle attacks accounted for 35 percent, according to the data.
The survey was conducted in April this year across the U.S, and a panel sample of 100 respondents from across the pharmaceuticals, medical devices, or life sciences industries with 501 or more employees were selected. These professionals must also support or manage OT security and networking as primary responsibilities while being involved in cybersecurity and networking purchase decisions.
Fortinet reported that 43 percent of respondents stated that implementing security solutions create business concerns, 42 percent said that they create more complexity, and 37 percent said that they require challenging adoption of security standards. This shows how important it is for those involved in cybersecurity to reframe the conversation within their organizations and help security to be seen as a growth enabler instead of a cost center.
As the pharmaceuticals industry has become increasingly customer-focused and data-driven to stay ahead of the competition, many companies are investing in new or improved solutions to boost efficiency. At the same time, cybercriminals are becoming increasingly sophisticated, well-armed, and ready to take advantage of any gaps they find in enterprise IT estates.
The pharmaceuticals industry operates in a complex partner ecosystem of universities and research centers, labs, manufacturing facilities, and hospitals, demanding a high degree of security across all connections to protect highly coveted intellectual property and maintain the privacy of patients. Damage from insider sources can be hard to detect and deter because the attacks represent a wide range of behaviors and motives. It could be a disgruntled employee wanting to disrupt operations, a staff member hoping to sell valuable data, or even a well-intentioned co-worker accidentally sidestepping a security policy.
In addition, several transformative changes have also been observed in the pharmaceuticals industry and their use of connected digital technologies. Like with several organizations that integrate IT and OT systems, and use cloud solutions for data processing and global ecosystem collaboration, Fortinet observed that IT/OT convergence and network complexity have the biggest impact on enhancing or changing cybersecurity within the pharmaceuticals industry, according to the report.
In many cases, these changes are creating an expanded cyberattack surface. As OT systems that were previously siloed from wider networks are now using the same networks as traditional IT systems, these OT systems are now vulnerable to typical IT system attacks, Fortinet said. Worse still, the attack surface for an OT system can include industrial Internet of Things (IIoT) devices, which control critical systems that can have potentially dire health and safety consequences if they’re breached.
At the same time, some organizations are focusing on operational transformations at the expense of cybersecurity, leaving many without the end-to-end, scalable security measures they need to protect their systems and data.
At most pharmaceutical manufacturing organizations, siloed systems for IT, OT, and physical security are the default, and this does not help matters, the Fortinet report said. Integrating just the IT security architecture among the data center, multiple clouds, and the edge is hard enough, according to the report. But in an age when adversaries can coordinate cyber and physical attacks simultaneously, integrating all elements of security with centralized visibility may be the only viable means of protection.
It all adds up to create an industry where OT systems are increasingly barraged with both recycled IT-based attacks and purpose-built OT exploits. Attacks on the pharmaceutical manufacturing sector’s critical infrastructure can lead to financial loss, compromised trials, contaminated drugs, delivery delays, a risk to brand reputation, and sometimes even loss of life or threats to national security, according to the report.
Some of the pharmaceuticals companies who participated in the survey report that their organizations have been largely unsuccessful at preventing cybercriminals from intruding in their systems, according to Fortinet.
Digital innovation efforts and the fast growth of the Internet of Medical Things (IoMT) have opened up vulnerabilities in pharmaceutical companies. Over the years, cloud migrations, connected medicine and telehealth, remote employees, and pop-up vaccination clinics have only increased the number of attack vectors across pharmaceutical manufacturing, leading to a spike in ransomware and phishing attempts.
Fortinet found that 30 percent of organizations say they needed to adapt their existing technology to support remote work. Interestingly, only about one in ten will continue what they have implemented. Most companies will go back to former processes and/or continue to seek new ways to streamline processes and reduce cost after the pandemic, the report revealed.
A complimentary guide to the who`s who in industrial cybersecurity tech & solutions
Free DownloadRelated
