By Jonathan Nguyen-Duy, Vice President, Global Field CISO at Fortinet

Industry Perspectives

Of all the changes brought on by the pandemic, remote working as a standard business model is probably the most transformative. The result for some was improved work-life balance, as 90-minute commutes were replaced by more exercise and breakfast with the kids. But this massive shift, including the shift from trusted computing to untrusted networks, also introduced new cybersecurity threats. With many employees no longer protected by company firewalls and security protocols, new risks were introduced, especially around cloud migration and endpoint proliferation. 

Protection encompasses the entire cyber-physical environment of your data, data centers, carriers, users, critical infrastructure, and ecosystem, including partners, manufacturing plants, research and development centers, offices, and, most recently, remote workers. The pharmaceutical industry is not immune to these new challenges, with both large and small pharmaceutical companies being targeted by threat actors. Pharma also faces significant cybersecurity challenges brought on by the increased enablement of remote and distributed work within the pharmaceutical industry.

What’s Valuable is a Target within the Pharmaceutical Industry

Cybercriminals are capitalizing on the expanded attack surface and “reversed” networks, caused, in part, by the increased number of remote workers within the pharmaceutical industry. With everyone distracted by remote work, cybercriminals see opportunities to attack and steal valuable research and intellectual property. One of their most well-known tactics involves distributing ransomware designed to freeze organizations and interrupt or steal research and developments. 

The Pharmaceutical Industry Faces the Challenges of Maintaining Security for Remote Working

Recent data breaches within the pharmaceutical industry have resulted in hundreds of millions of dollars in lost proprietary information and pharmaceutical research. The increasing array of endpoints that come with remote working opens doors to potential security breaches especially with increased cloud migration and device proliferation. Additionally, expanding partnerships, including R&D partners, represent a potential critical point of entry to malicious actors as they target bigger pharmaceutical businesses through weaker access points within their wider ecosystem. Without a holistic, end-to-end security solution, it is likely only a matter of time before becoming a target. 

Despite the reality of this risk-filled environment, there are many challenges for pharmaceuticals looking to implement advanced security measures. Perhaps the greatest challenge and threat is the enablement of distributed remote working, globally and at speed, as it adds risk and makes huge demands on security systems. Mass remote working may have become obligatory for many pharmaceutical workforces, but the need to integrate vulnerable legacy operational technology and the rising value of pharmaceutical intellectual property has seen the industry identified as a vulnerable and lucrative target. 

Last, but not least, of the operational challenges are the inconsistent attitudes and perceptions of risk and how those two factors can influence leadership’s appetite to protect vulnerable legacy operational technology. An increasingly digital pharmaceutical value chain demands a broader security framework to protect valuable data as it moves between a complex network of remote workforces and partners using disparate network, cloud, application, and mobile environments.

“Workforce mobilization has expanded the threat landscape dramatically, requiring organizations to evaluate and implement Zero Trust to protect all users and devices across the entire healthcare life science cyber edge.”  Troy Ament, Fortinet Field CISO Healthcare Life Science

Solutions for Remote Security in the Pharmaceutical Industry

Digital transformation and the rise of software-defined enterprises has created a persistent and growing cyber risk across a widening cyber-physical landscape. Pharmaceutical companies are focused on maintaining integrity across increasingly remote-based working environments. The key to integrity for remote workers is securing endpoints and access to distributed computing resources. Protecting this increasingly virtual and collaborative ecosystem, regardless of device or network, through the visibility of data and control of credentials is critical. Multi-Factor Authentication alongside actionable intelligence is a necessity for remote work security. Next-generation endpoint security provides real-time automated endpoint protection, detection, and response, while platform and firewall capacity enable safe throughput and processing of IP publicly identifiable information.

Beyond offering encryption of data in transit, via a VPN, a number of other features can help pharmaceuticals secure their cloud migrated remote workforce. Utilizing Data Loss Prevention (DLP) is essential for teleworking executives with frequent access to important and sensitive customer and operational data.¹ Additional advanced threat protection involves analyzing malware and other suspicious content within a sandboxed environment before it reaches its destination to help prevent breaches.² It’s critical for pharmaceuticals to provide secure wireless connectivity and access at remote work locations with full integration and configuration management.³

Convergence

“The pandemic has created higher demand for additional internet-based connectivity into the sensitive supply chain, R&D, and OT networks, creating a need for IT and OT infrastructures to collaborate. OT cybersecurity has started to depend on more traditional IT facilities like patching, cloud-based threat intelligence, protection mechanisms, VPN and remote access; a clear sign that organizations need to start integrating OT cybersecurity into everyday cybersecurity considerations.” Zhanwei Chan, Global Head of OT/IoT Practice, NTT Ltd.

Looking Back and Ahead in Pharmaceuticals

Pharmaceutical industries can only succeed and grow through the secure flow of data across connected IT and OT environments within complex, evolving ecosystems. Cybercriminals are targeting pharmaceuticals due to the increased focus on cloud migration and a recent increase in remote workers. These knowledge workers are indeed lucrative targets, often handling intellectual property worth billions of dollars. With global brand reputations and groundbreaking R&D on the line, speed and the pressures of non-disruption cannot come at the expense of security. These are challenges that should not sit solely on the shoulders of IT.