Staying Safe in the Cloud:

Plant process management systems and other networked applications contain a wealth of valuable data, making them a tempting target for hackers and data thieves. Manufacturers in 24/7 process industries such as pharmaceuticals also have unique vulnerabilities to operational disruption from cyberattacks such as ransomware attacks or software supply chain attacks. A data breach or data loss can put pharmaceutical plants at significant risk. Some of these risks include:

• Loss or theft of valuable IP
• Disruptions to operations due to data loss or ransomware attacks
• Safety incidents caused by missing or altered data
• Regulatory compliance issues
• Financial loss and risks to business continuity

For all these reasons, data security is an essential consideration for PPM software. There are three important aspects of data security to consider. Is the data protected from unauthorized access? Is the data accurate and complete? And is the data available when and where you need it? These three pillars of data security—confidentiality, integrity and availability—are commonly referred to as the CIA triad.

1. Confidentiality: Confidentiality refers to the protection of data from unauthorized access and disclosure. Confidentiality ensures that only authorized users or entities can access and view the data. This can be achieved through access controls, encryption, and other security measures.
2. Integrity: Integrity refers to the accuracy and completeness of data. It ensures that data has not been tampered with, altered, or destroyed in an unauthorized manner. This can be achieved through measures such as data validation and digital signatures.
3. Availability: Availability refers to the accessibility and usability of data. It ensures that data is available to authorized users when they need it and that it is not inaccessible due to system outages, network failures, or other disruptions. This can be achieved through measures such as backup and disaster recovery planning and redundancy.

To protect companies from business disruptions and losses, the PPM solution must be designed to address all three elements of the CIA triad.

Many organizations believe that keeping data on their own network is safer than trusting it to a cloud-based service provider. After all, you know exactly where your data is and how it is stored. However, storing data on your own network may not be as secure as you think. Locally hosted data and applications exist within a complex IT ecosystem that provides plenty of opportunities for data theft, loss or tampering. Here's why.

• Most pharmaceutical manufacturers are using legacy architecture for their networks, which may not be up to modern standards for cybersecurity. Known vulnerabilities in older legacy systems create a tempting target for cybercriminals.
• Third-party software installed on the network may create new and unknown security vulnerabilities, either by creating unanticipated back doors into other data and systems on the network or through intentional software supply chain attacks.
• IT staff may not have the resources or knowledge to keep software and systems up to date, monitor the security landscape, and respond to emerging security threats. As a result, software may not receive all the appropriate security patches and updates, and signs of a data breach or attack may be missed.
• If data on local servers is destroyed or damaged—or held hostage in a ransomware attack—there may not be an adequate disaster recovery plan in place to quickly bring systems and data back online. Local data that is not backed up elsewhere is vulnerable to permanent loss.
• Few pharmaceutical companies have enough dedicated cybersecurity expertise on staff to develop and implement a strategic global cybersecurity plan to keep sensitive data safe for the long term.

• Reduced attack surface: By accessing software through a browser, the user is not installing or running software on their own network, which reduces the attack surface for potential attackers. A secure cloud-based system also protects manufacturers against software supply chain attacks.
• Automatic updates: The CSP is responsible for updating and patching the software running on their infrastructure, which reduces the burden on the pharmaceutical company to keep their software up-to-date and secure.
• Secure architecture: Cloud software should be designed with security in mind and include built-in security features such as encryption, access controls, and threat detection.
• Centralized security management: By using cloud software, the pharmaceutical company can depend on the CSP's centralized security management and monitoring, which will generally have an enhanced ability to detect and respond to security threats.
• Stronger security controls: Cloud service providers are often subject to strict security standards and certifications, such as ISO 27001, which can provide assurance that the CSP has implemented strong security controls.

A Software-as-a-Service (SaaS) model allows manufacturers to leverage the security capabilities of the CSP, reducing the burden on the pharmaceutical company to manage and secure their own software and providing a more centralized and secure approach to software management.

Cloud security encompasses a number of best practices designed to ensure data confidentiality, integrity and availability. These include system architecture, software development practices, backup and disaster recovery planning, security monitoring, testing and analysis, and incident management.

Architecture

Secure cloud architecture includes a combination of best practices, policies and technologies that work together to protect data, applications and infrastructure in a cloud computing environment. Important elements of secure design for cloud applications include:

• Identity and access management for authorized users (e.g., password or multi-factor authentication systems, support for single sign-on or third-party authentication systems, role-based access control, etc.).
• Data encryption to protect data both during transmission and storage. For example, HTTPS should be used for encrypted communication between the web browser and the cloud application, and sensitive data should be encrypted on the application's servers.
• Network security measures, which may include multiple levels of firewalls, intrusion detection technologies, and network segmentation to isolate customer data (multi-tenant architecture).
• Application-level security measures, such as secure coding practices and regular vulnerability assessments and penetration testing.

Software Development Practices

Secure software development integrates cybersecurity at every stage of development and operations—a practice known as "DevSecOps." Cloud services for sensitive and mission-critical software used by the pharmaceutical industry should be developed using a DevSecOps approach. This includes:

• Implementing best practices in secure software development at the earliest stages of development.
• Using good security practices for software building and versioning.
• Creating processes for testing and evaluating security throughout the product lifecycle.
• Employing adaptive security measures that allow software to detect and respond to changes in the security environment.
• Securing the distribution channels for software updates and rolling out new versions to users post-deployment.

Backup and Disaster Recovery

Backup and disaster recovery planning is one of the keys to data availability and integrity. Where are servers physically located? How (and how often) is client data backed up? How is the application itself backed up? What is the recovery plan in the case that servers are physically destroyed or otherwise unavailable—for example, due to a natural disaster at the data center? Geo-redundant servers and database backups, in which data and applications are stored in more than one geographic location, significantly decrease the risk of catastrophic data loss. It is also important to have a backup schedule appropriate for the business and the type of data being stored. The CSP should have a fully documented backup and disaster recovery plan that outlines backup frequency, primary and backup server locations, automated recovery methods, security measures for backups, and recovery time objectives.

Security Monitoring

Security monitoring for cloud-based PPM solutions should be ongoing, comprehensive and multi-layered. A security monitoring program includes both external and internal monitoring.

• External threat surveillance: The threat landscape is continually changing as malware and attack methods evolve and new vulnerabilities are discovered. Threat Intelligence teams need to be aware of new threats that could impact their applications or the hardware and software ecosystem they connect to, such as the browser or device operating systems. Threat intelligence may include a combination of automated methods (such as "honeypots") and manual monitoring of information available through open-source security forums.
• Internal threat monitoring: Real-time, automated monitoring of system health, availability and performance allows providers to respond quickly if a problem develops. This includes endpoint monitoring for the devices that connect to the service to detect unusual patterns of behavior that may indicate a breach.

Testing and Analysis

Regular testing and analysis of the infrastructure and hosted application are crucial. This typically includes external black-box and gray-box penetration testing and threat modeling for both the software and the infrastructure, as well as internal analysis to detect signs of current or past attacks. These tests are used to discover previously unidentified vulnerabilities and inform development of software patches or other mitigations to harden the system.

Incident Management

CSPs also must have an incident management and response plan in the event that a problem that impacts data confidentiality, integrity or availability is discovered. This includes procedures for detection, communication, mitigation and forensic analysis of security events.