Cyber Defense Foundations for Pharma & Healthcare: Securing ICS/OT in Pharmaceutical Manufacturing & IoT in Healthcare (Part 1)

Introduction

The pharmaceutical and healthcare industries are undergoing rapid digital transformation. In pharmaceutical manufacturing, Industrial Control Systems (ICS) and Operational Technology (OT) drive automation, precision, and efficiency in medicine production. Meanwhile, the Internet of Things (IoT) is revolutionizing healthcare by enabling real-time patient monitoring and smart medical devices.

While both sectors rely on connected technologies, they face unique cybersecurity challenges. Effective ICS/OT security approaches, such as the SANS 5 ICS Cybersecurity Critical Controls, are designed for industrial environments like pharmaceutical and chemical manufacturing. However, these same controls may not be directly or easily applied to IoT in healthcare, which operates more IT-driven, patient-focused environments.

Addressing cybersecurity in these industries requires targeted, environment-specific approaches that protect both critical infrastructure production facilities and patient safety.

Cybersecurity in Pharmaceutical Manufacturing: ICS & OT Risks

Pharmaceutical and raw chemical manufacturing depends on automated control systems, including Programmable Logic Controllers (PLCs), Distributed Control Systems (DCS), and Supervisory Control and Data Acquisition (SCADA) networks complete production batches. These systems ensure the precise formulation and production of medicine, making them attractive targets for cyber threats for:

• Intellectual Property Theft: Stealing medicine formulations and production processes stored ICS/OT assets like data historians or recipe management systems.
• Industrial Espionage: Nation-state actors targeting pharmaceutical firms to obtain proprietary drug formulas.
• Process Manipulation: Cyber attackers modifying control system parameters, leading to unsafe drug compositions, safety consequences, or compliance violations.

ICS/OT Data Historians Case Study: Intellectual Property Thief in Pharma

Let’s look at an example of intellectual property (IP) theft in pharmaceutical manufacturing targeting the data historian, a critical ICS asset.

Data historians are usually a cluster of connected traditional operating systems that store real-time and historical process data, including batch records, environmental conditions, and, most critically, the formulation recipes for medicine production. If an attacker gains access to the data historian, they could steal proprietary formulas—leading to severe financial and competitive consequences.

Beyond IP theft, an attack on the historian could also involve modifying compliance records, potentially triggering regulatory violations or FDA recalls.

While targeting the data historian presents the most direct and damaging method of IP theft, attackers may also exploit other ICS components. Compromising PLCs, for example, could allow manipulation of pharmaceutical batch parameters, resulting in unsafe or ineffective drugs. This type of attack not only undermines product quality but also poses serious public health risks.

Protecting the data historian requires a multi-layered security approach to prevent unauthorized access and intellectual property theft:

• Strict Access Controls: Limiting access to authorized personnel only.
• Network Segmentation: isolating the historian from IT systems and the internet to reduce exposure to external threats.
• Continuous Monitoring: Detecting unauthorized data extraction and command-and-control (C2) activity helps detect cyber intrusions before they can compromise sensitive information.
• Encryption: Protecting data at rest and in transit to ensure data integrity and confidentiality.
• Robust Backup Strategies: Ensuring data availability in case of cyber-attacks or accidental loss.

To further mitigate these threats, pharmaceutical companies can apply the SANS 5 ICS Cybersecurity Critical Controls, a high-ROI security framework specifically designed for ICS/OT environments.

IoT Cybersecurity in Healthcare: A Different Security Challenge

Unlike ICS/OT in pharmaceutical manufacturing, IoT devices in healthcare operate in highly dynamic, patient-facing environments where security must balance with life-critical processes.

Unsecured medical devices, such as IoT-enabled infusion pumps, pacemakers, and patient monitors, often lack strong security protections, making them susceptible to cyber threats while actively aiding patients. Ransomware attacks and data breaches further expand risks, as attackers can encrypt patient records or compromise critical medical devices, potentially disrupting hospital operations and patient care.

Another major concern is IoT supply chain security, as many medical devices depend on third-party vendors, increasing the risk of backdoor exploits or of vulnerable firmware. Unlike traditional IT systems that follow structured patching processes, many IoT devices in healthcare environments are difficult, or even impossible, to patch once deployed, leaving them exposed to long-term security threats.

Securing Healthcare IoT Devices: Best Practices

Medical IoT devices play a critical role in patient care, making proactive security measures essential. Unlike ICS/OT environments, IoT security in healthcare must focus on patient safety, data privacy, and device availability.

Best practices include:

• Strong Authentication and Encryption: Ensuring only authorized medical staff can access, change, update, or read devices data while protecting patient information.
• Network Segmentation: Isolating medical devices from critical hospital systems to prevent cyber threats from spreading.

A Tailored Cybersecurity Approach for Pharma & Healthcare

Pharmaceutical manufacturing and healthcare facilities face evolving cybersecurity threats that demand tailored security approaches.

The SANS 5 ICS Cybersecurity Critical Controls provide a strong threat-based framework for securing pharmaceutical ICS facilities, including protecting data historians, safeguarding intellectual property, maintaining compliance, and preventing network abuse. Meanwhile, healthcare IoT security requires specialized protections suited to medical devices, patient care, and life-critical environments.

Continued Learning and Education

For more in-depth, practical training on ICS/OT cybersecurity, check out:

• ICS410: ICS/SCADA Security Essentials – Foundational training in ICS/OT cybersecurity.
• ICS515: ICS Visibility, Detection, and Response – Advanced ICS/OT cybersecurity training.

Additionally, visit the SANS Healthcare Cybersecurity News & Resources page for the latest updates on securing medical IoT environments.

Join Us for the 20th Anniversary SANS ICS Summit!

Join me in person at the 20th Anniversary SANS ICS Security Summit! Whether you’re new to the field or an experienced professional, working in ICS/OT or IT cybersecurity, this is a must-attend event for anyone serious about protecting critical infrastructure.

This year, we’re introducing a new expanded three-day format, packed with even more hands-on workshops, expert-led discussions, and real-world defense strategies tailored for ICS cybersecurity. The in-person experience gives you direct access to industry “in-the-field” leaders, immersive, hands-on engagement with real ICS equipment, and networking opportunities you won’t find anywhere else.

And don’t stop with the Summit! Extend your stay and take advantage of specialized ICS security training courses immediately afterward. I’ll be teaching ICS418^TM: ICS Security Essentials for Leaders^TM, a course designed to equip security and operations leaders with the essential knowledge needed to manage ICS cybersecurity risks effectively.

If you’re looking to level up your expertise and bring actionable knowledge back to your organization, this is your chance. Don’t just hear about it—experience it. Be part of the mission.

See you at Disney’s Contemporary Resort, June 15-17. Register now!