In a world of increasing cyber-risk are you confident your EMS partner has all the right information security measures in place to protect your IP?
Traditionally, manufacturing companies have been leaky vessels. IP theft and loss has been endemic in the industry. In fact, research by Make UK found that half of all manufacturing companies had been victims of cybercrime. And with the extraordinary commercial value of the data they handle, it’s easy to see why.
Covid 19 saw a spate of attempted, state-sponsored hacks and thefts of vaccine IP from manufacturers working on behalf of drug designers. Meanwhile, PCBA designers have known for years the devastating potential for IP theft in their multi-million dollar industry:
“Formulas, source code, and other IP can be prime theft targets in chip development. Design information in CAD files can be harder to protect than structured data. Implementing best practices, including encrypted transmission uploading and rigorous user authentication, is critical.” Rich Baker at Protolabs
But while many data breaches occur following deliberate hacks, research from Kroll shows over 50% of all IP leaks originate from employees, contractors and third-party suppliers.
Given the state of information security in most manufacturing businesses, that should come as no surprise.
In May 2019 an employee of a US aviation firm downloaded 18,000 confidential design files onto a single USB stick, handed in his resignation, and walked calmly out of his office. Two years later he received a $250K fine and a 20-month prison sentence for attempting to sell information to a rival firm and lying to the FBI. Is your team and supplier network protected from cyber theft?
For modern OEMs there has always been an increased opportunity for both accidental and intentional breaches of confidential data because of their complex, global web of external dependencies. Their use of different consultants, third-party contractors, ODMs and EMS makes policing every contact and business a big challenge.
This risk is increased by the sheer number of ways in which information is now transferred between organisations. With individuals using everything from email and Slack, to WeTransfer, DropBox, Google Docs, and OneDrive - the truth is, the chain is only as strong as its weakest link.
Not only this but there are a whole load of physical and environmental security risks that can be overlooked by businesses with lots of employees spread out across sprawling, global campuses.
Unless a business has a defined set of data security processes and procedures that everyone always observes, sooner or later some kind of breach is bound to occur.
Some questions for you:
As manufacturing is a massive, global ecosystem, supplier relationships are often dealt with remotely. Completing due diligence under these conditions can be a complex process. If you are dealing with a long-distance partnership, what information are you relying on to vet your suppliers? Are you weighting cyber and physical data security appropriately when you choose a partner?
With all this in mind, OEMs are strongly advised to look for EMS partners who have gained the ISO 27001 standard, to give you the confidence they can control data and properly protect the IP you are sharing with them.
ISO 27001:2013 is the international standard for Information Security Management Systems (ISMS). The standard defines a risk-based approach to data security, requiring organisations to identify breach risks within their company and adopt appropriate controls across their business to tackle them.
ISO 27001 builds a shared culture of data security across an organisation to help protect IP against malicious and accidental loss. It gives you the process and procedures to:
If your EMS has ISO 27001:2013, then they have the tools to:
It’s important to remember that it’s not just cyber threats that can endanger your data, but lapses in perimeter security, equipment security, access control, documentation storage and WFH policy. With EMS companies spread out in multiple locations across the world it may be impossible to all visit the premises where your product will be designed and manufactured, so you need external verification that processes and procedures are followed at all times. ISO 27001 is your independent guarantee that an overarching ISMS exists and is in force across an entire organisation.
OEMs often require their manufacturing partners to have gained ISO 9001, ISO 13485 and a host of other standards. But still, they forget about ISO 27001:2013. As the nature and sophistication of cyber threats and IP theft evolve, businesses need to be confident of the information security of all links in the supply chain. The more fragmented the chain, the greater the risk of gaps emerging. Demanding ISO 27001 certification from all your suppliers will help you seal the joins and protect your IP.