From high-end to high-security: Operational technology cybersecurity transformation for a luxury goods leader

Production downtime can be disastrous for manufacturers. For one maker of luxury goods, getting ahead of operational disruption has become a priority as the company has integrated more digital capabilities to support and enhance its traditionally manually intensive business and its focus on crafting high-quality products for consumers worldwide.

In looking at the company’s longer-term digital evolution, company leaders recognized that their traditional business was becoming more complex. OT and IT were intersecting in new ways and creating new opportunities for cyber threat actors and others to disrupt operations.

From ransomware attackers to hacker-activists (“hacktivists”) targeting the luxury goods industry, there was no shortage of potential threats for the high-profile company and its multiple manufacturing sites in Europe.

Leaders understood that isolating risks across the OT/IT environment would be key to business resilience—to ensure that disruptions in one part of the business could be contained and remediated while having minimal impact on other business processes. They also understood that, to evolve with confidence and continue to operate efficiently, the business required a more strategic, end-to-end approach to OT cybersecurity, along with a greater understanding of its own technology environment.

Enabling “island mode” was also a vital need, to allow processes or assets to continue to operate effectively as an isolated “island” in the event of a disruption to a connected process or asset. Deloitte supported the segmentation of IT and OT environments through both high-level design (HLD) and low-level design (LLD), even working with the company on design needs for a planned factory. With a new security reference architecture and guiding policy, a new view of its assets, and new segmentation across its environment, it was also critical for the company to train both IT staff and internal end users. To set the company up for success, Deloitte developed detailed training materials to support implementation, as well as a broader set of educational resources to help drive policy compliance, ensure internal alignment on security objectives, and get ahead of potential employee questions or concerns.

The combined team devised a comprehensive policy that addressed more than a dozen key topics including asset management, vulnerability management, backup management, remote access, account management, and password protocols. These focus areas were central to the design and implementation of a secure, effective future OT environment. The manufacturer was able to achieve its business goal of securing the IT and OT environments while maintaining business continuity and reducing the risk of production interruptions.