OT Cybersecurity Champions: Extending Cybersecurity into the Business

Hatteras Hoops

Senior Associate – Cyber Governance, Policy, and Threat, Booz Allen Hamilton

In the dynamic realm of global manufacturing operations, extending cybersecurity into the business is a game-changer. Critically important global organizations operating across multiple sites are prime targets for threat groups. To meet this and other risks, your organization can strengthen cybersecurity hygiene through captivating awareness & upskilling engagement aimed at engaging and empowering your non-cyber workforce.

Observations and Solutions

Through a process of building, launching, operationalizing, revising, and improving, Booz Allen extended Operational Technology (OT) Cybersecurity into the business from plants to final assembly lines, from technicians on the floor to the back-office chatter in the breakroom among machine operators and engineers. Our approach was based on these key observations:

• Observation: Lack of a formal process and mechanism of attracting cyber-Champions, a group of people outside of an OT security team, that serve as liaisons to security through collaboration, leadership and sponsorship. Solution: Develop a champion attraction method and process
• Observation: Without a formal engagement and development plan, cyber-Champions struggle to identify opportunities, drive innovation and empowering other stakeholders in the Champions Network. Solution: Design Security Champions engagement tools and Security training.
• Observation: Absence of a formal engagement network and consistent branding supported by targeted publicity efforts across the enterprise, inhibits optimal awareness of OT security and associated risks. Solution: Develop and implement awareness publicity plan.

Meeting the challenge in unconventional ways

The challenge to our team was to instill good cyber hygiene among technicians who are closely involved with potential industrial incidents. This was accomplished through engaging, stimulating, and people-centric approaches. We applied the use of comics, use-cases, videos, site visits, gamifications, and community solutioning. This saw increased engagement across a global, multi-national company by over 40%, enhanced reach of the OT Cybersecurity team by 30%, and increased collaboration between sites by over 20%.

Collaboration revealed and multiplied solutions existing from one locale to another saving money, time, and effort. We helped unmask the heroes across the organization focused on safety, uptime, and process familiarity. This network continues to expand as a low-cost, active network of heroes from across all corners of earth.