Security Risk Management in CPG Manufacturing

Summary

Verve worked with a leading Consumer Packaged Goods manufacturer to drive measurable and rapid improvements in their OT/ICS security, combining Verve Security Center and Verve Industrial Protection (VIP) services.

After a successful pilot project at a European facility where Verve conducted a technology-enabled vulnerability assessment, the client chose Verve as its global OT/ICS security platform and VIP services to deploy Verve and key third-party, integrated security components. Over a 12-month period, the CPG manufacturer achieved visible improvements in security by gaining deep asset inventory, risk visualization, and remediation across their global footprint from the United States to Europe to Asia.

The Challenge

A leading consumer goods manufacturer completed an IT security transformation and sought to achieve the same level of security and systems management in OT as they had in IT.

Unfortunately, the OT team was not well- versed in security and had a wide variety of security approaches and overall OT ICS security maturity. Like many companies in the manufacturing sector, this organization went through multiple acquisitions and had different security strategies based on the plant it was acquired from.

The CISO and the board wanted a consistent IT/OT security approach so they could manage the overall security profile of the company. They needed a solution that could deliver similar IT security functionality, but take into account the complexities and sensitivities of manufacturing devices.

The Solution

Verve brought together the Verve Security Center platform and our VIP services to provide a turnkey solution to OT/ICS security. The client first deployed VSC to one site to ensure ease-of-use and product capability for plant IT to manage the solution. Based on the success of this initial plant, the rolled out VSC globally.

The first key characteristic of the solution was a simple, global deployment and maintenance operation given their limited plant staff. Verve’s software-based architecture, without the need for on-site deployment of hardware, was paramount to their success.

Second, the platform needed to enable rapid remediation to demonstrate progress. Verve’s closed-loop architecture ensured that the minute the software was deployed, remediation could begin.

Third, the solution needed to scale to enable central resources to analyze risks and plan remediation. Verve’s Think Global; Act Local architecture allowed central IT/ OT teams to evaluate risks, plan for remediation and design actions that could be distributed to sites for local automation.

The Verve services team deployed backup, application whitelisting, and other security tools alongside VSC and integrated those into the Verve dashboards for a single view into the client’s OT/ICS security requirements.

The Impact

Over a six month period of time, Verve and the client delivered measurable security improvements to the plants globally. Remote deployment and VIP services significantly reduced cost and time to maturity. The client delivered significant improvements without adding significant headcount.

Moreover, they were able to match its security capabilities across their entire global manufacturing footprint.