2018 Smart Pharma - Pharmaceutical Industry

Smart Pharma2018

eBOOK

TABLE OF CONTENTSDealing With Digital Demons 3

To advance, pharma must confront its digital transformation fears head-on

Turning a Buzzword Into Exponential Impact 9

How data is changing pharma operations

Boosting Cybersecurity in Pharma 16

Appropriate defensive measures are key to protection, starting with

a security risk assessment

eBOOK: 2018 Smart Pharma 2

www.PharmaManufacturing.com

Every industry has its demons. The

pharmaceutical industry’s strug-

gles — its aversion to risk, fear of

regulatory backlash, the siloed nature

of its organizational structure — are

well documented.

But today’s developing environment —

coined the Fourth Industrial Revolution

and characterized by rapidly evolving and

disruptive advances in technology — has

created a new and intimidating landscape.

According to the World Economic Forum,

this current revolution is “reshaping indus-

tries, blurring geographical boundaries,

challenging existing regulatory frameworks,

and even redefining what it means to be

human.”1 In this new world, tools such as

automation, IIoT, cloud-computing and data

analytics offer all industries the potential for

digital transformation — if they can properly

understand and implement them.

Pharmaceutical Manufacturing’s second

annual Smart Pharma survey separately

asked drug manufacturers and equipment

and services vendors their thoughts on

the pharma industry’s digital transforma-

tion progress.

Close analysis of the survey results confirms

a lot of what we already know: The pharma-

ceutical industry has seen great advances in

transformative technology, and it’s becom-

ing increasingly evident that if properly

harnessed, many of these innovations can

give manufacturers an edge. But recent

survey results closely mirror the responses

from last year — and the concern is that this

could mean progress is stalling.

Dealing With Digital DemonsTo advance, pharma must confront its digital transformation fears head-on

By Karen Langhauser, Chief Content Director



In order to keep moving forward and propel

itself into the next stage of digital trans-

formation, pharma needs to confront some

very real challenges.

THEY BELIEVEThe good news is that pharma believes

in digital. Over 70 percent of surveyed

pharma manufacturers see the big pic-

ture, understanding that in the long-run,

a more automated pharma industry will

improve productivity, quality, and efficiency

— and cut costs. This year, the number of

manufacturers who specifically indicated

a connection between automation and

cost-cutting jumped from 55 to 71 percent

— perhaps a positive sign that manufac-

turers are starting to see actual financial

benefits from successful digital initiatives.

Cultural buy-in, especially from a traditionally

conservative industry, is also crucial for suc-

cess. According to survey results, the industry

is noting a rising comfort level with the new

computing, control and communications

technologies represented by the IIoT. Over

79 percent of pharma respondents noted an

increase in automation-related comfort in

the industry, while 83 percent of vendors (up

15 percent from last year) agreed that the

pharma workforce’s comfort level is rising.

Encouragingly, when it comes to designing

or upgrading manufacturing facilities, 87

percent of manufacturers and 91 percent

of vendors said that digitalization is part of

the discussion. Of this group, 36 percent of

manufacturers said digitalization is actually

the leading priority.

AT STARTING GATE IDENTIFYING PILOT APPLICATIONS INVESTING IN APPLICATIONS

Ven

do

r R

esp

on

se

Phar

ma

Res

po

nse

All

Mfg

ing

/Pro

cess

ing

33.5%

46%

55%

Ven

do

r R

esp

on

se

Phar

ma

Res

po

nse

All

Mfg

ing

/Pro

cess

ing 30.5%

41%

34%

Ven

do

r R

esp

on

se

Phar

ma

Res

po

nse

All

Mfg

ing

/Pro

cess

ing

36%

13%11%

Exhibit 1

Digital Transformation/IIoT Initiatives Progress



TECHNOLOGY IS LURKINGDigital technology is everywhere — firmly

embedded in our personal and professional

lives — to the point where it is difficult to

claim that a lack of technological innovation

is holding back progress.

Survey answers support the assertion that

the technological innovation needed for

pharma to succeed on its digital trans-

formation journey is available, and at

increasingly affordable costs, too.

When ranking their concerns surrounding

smart manufacturing plants, tech innovation

— specifically the concern that “technol-

ogy being offered to the pharma industry

is not advanced enough” — was second to

last on the list of manufacturers’ concerns

and dead-last according to vendors. But

perhaps vendors are warranted in giving

themselves a pat on the back, as it seems

that overall, the industry is confident that

the level of technology being offered is

advanced enough to do the job.

These results are in consonance with the

manufacturing sector in general, as well. At

the recent Smart Industry 2018 Conference

— an annual event geared toward accel-

erating the ongoing digital transformation

of manufacturing — the exhibit hall was

overflowing with innovative technologies.

Yet during three days of presentations, the

focus was not on technology, but instead,

how to integrate and use these new tools to

maximize benefits.

In pharma, there appears to be a debate

as to who is responsible for continuing to

advance this technology. According to

survey results, pharma manufacturers are

somewhat split between believing vendors

should be proactively leading the charge,

believing vendors should be reacting to the

needs of pharma companies, or believing

there should be collaboration between both

parties. Vendors, however, are more deci-

sive: Over 50 percent believe they should

be leading the innovation charge, while a

mere 12 percent feel they should be react-

ing to the demands of drug manufacturers.

REALITY CHECKLast year’s survey revealed that overall,

pharmaceutical manufacturers were more

1. INTEGRATION

Difficulty integrating new tech-

nology with existing lines

or equipment

2. REGULATORY HURDLES

Lack of regulatory buy-in or

understanding of new processes

3. EDUCATION

Training and keeping employees

up-to-date with new equipment/

processes

Top concerns for pharma manufacturers about

smart equipment



optimistic than vendors about the industry’s

digital transformation progress. This year’s

results saw that gap shrinking — perhaps

a natural balancing out as the industry, as

a whole, gains a clearer picture of where

they stand.

When asked to describe the pharma

industry’s collective progress on digital

transformation initiatives, the vast majority

(87 percent of manufacturers and 89 per-

cent of vendors) put the industry into one

of two categories: at the starting gate, with

focus on learning and exploration, or identi-

fying early applications to pilot.

Pharma shares this reality with other indus-

tries as well. A recent collaboration between

the World Economic Forum and McKinsey

& Co.1 found that more than 70 percent

of industrial companies are still either at

the start of their journeys or unable to go

beyond the pilot stage. The latter stage is

referred to as “pilot purgatory” — where

technology is rolled out experimentally at

reduced scale for an extended period due

to the inability or unwillingness to deploy at

a larger scale.

For pharma, when it comes to reaching

the more advanced stage — identifying

RES

EAR

CH

AN

D D

EVEL

OPM

ENT

PLA

NT

FLO

OR

PR

OD

UC

TIO

N

SUPP

LY C

HA

IN M

AN

AG

EMEN

T

QU

ALI

TY

CO

NTR

OL

EQU

IPM

ENT

MA

INTE

NA

NC

E

PAC

KA

GIN

G

OTH

ER

12%

5%

41.5%

35%15%

17%

24%

21%

7%

3%

7%

10%

3%2%

Pharma Manufacturers Vendors

What area of pharma manufacturing do you feel would see the most benefit from increased digitalization?

Exhibit 2

2%3%



applications and making investments to

match — it seems few manufacturers are

willing to make the financial leap. Even at

a basic level, when vendors were asked if

pharma companies were looking to replace

outdated equipment with improved robot-

ics or controls automation, only 6 percent

could decisively claim that most companies

are actively updating.

WHY PHARMA LOSES SLEEPWhat is keeping pharma up at night when

it comes to digitalization? When asked to

rank their companies’ concerns (or for ven-

dors, their customers’ concerns) regarding

smart equipment in plants, this year, both

manufacturers and vendors prioritized inte-

gration — specifically the potential difficulty

that comes with integrating new technology

with existing lines or equipment.

In pharma, managers of legacy facilities

are no strangers to addressing the prob-

lems associated with aging infrastructure,

equipment and processes. The need to

accommodate new, digital technology adds

an additional layer of complexity. Fortu-

nately, vendors are rising to the occasion,

providing ways to upgrade technology

without replacing existing machines.

Devices such as serial servers and media

converters can give existing equipment

new connectivity options and the ability

to communicate.

Regulatory hurdles slipped from the No. 1

concern to the second spot this year, for

both manufacturers and vendors. With

compliance being essential in pharma, it

makes sense that lack of regulatory buy-in

or understanding of new processes would

continue to be a challenge. When vendors

were asked directly what they thought was

the top issue holding back their customers’

digital progress, fear of regulatory back-

lash (30 percent) and an unwillingness to

pioneer unproven technology (27 percent)

topped the list.

But as the industry progresses down its

digital path, it’s important to involve reg-

ulators early and often. According to the

BioPhorum Operations Group, (a cross-in-

dustry collaboration), pharma’s transition

will require “diligence by industry to show

regulators the benefits of the move, but still

According to survey results, larger, U.S-based

biopharma manufacturers are the most highly

automated and digitally advanced in the industry



show the ability to maintain data integrity,

demonstrate control and custody of oper-

ating software in an open environment, and

validate the use of real-time release instru-

ments and process models.”2

TIME TO LOOK UNDER THE BEDFor a second survey year in row, pharma is

finding itself at a familiar digital transforma-

tion crossroads: The industry understands

the power of digital, has made a few pilot

investments, but can’t continue its journey

without fully investing.

And pharma isn’t alone. During this year’s

Smart Industry Conference, Brian Irwin,

automotive and industrial lead for IT consul-

tancy giant, Accenture, pointed to research

across multiple industries indicating that

while 80 percent of industry executives

expect both efficiency and growth from

digital, only 13 percent are investing cor-

respondingly. Across all industries, Irwin

confirms, very few companies have made

it to the phase of digitalization where they

have found a way to see growth and profits

from their digitalized business model.

Exactly how far away is pharma from truly

reaping all the benefits of IIoT and the smart

factory? According to our survey results,

64 percent of pharma manufacturers and

86 percent of vendors believe the industry

is five to 10 years away. Yet, 27 percent of

manufacturers still feel the industry is more

than a decade away from reaching this goal,

or will never actually get there — demon-

strating that equivocation is still very real.

But this hesitation, according to McKinsey

& Co., may not be the best course of action.

McKinsey analysts (see the article on the

next page) describe small-scale digital

initiatives and pilot investments as “self-lim-

iting,” warning that they “will not generate

the kind of dramatic results that leaders

expect, potentially threatening future

investments.” Instead, experts insist that

in order to take full advantage of digital,

companies need to think in comprehensive

terms, by making more dramatic, sys-

temic changes.

“Launching a ‘digital transformation’ can

seem ambitious. But tentative half-mea-

sures will not capture the full potential from

technology,” says McKinsey.

Those looking to keep up with frontrunners

will need to put fears aside and confront

their digital demons head-on, pushing

themselves itself into the most rewarding

stage of digital transformation.

REFERENCES1. The Next Economic Growth Engine

Scaling Fourth Industrial Revolution

Technologies in Production. World Eco-

nomic Forum, January 2018.

2. The Technology Roadmap for the Bio-

pharmaceutical Manufacturing Industry.

BioPhorum Operations Group, July 2017.



Aircraft today can be fully devel-

oped in a digital environment.

They are designed using CAD soft-

ware and tested in a virtual flight simulator,

before any physical work happens. Imagine

the same in pharma: A COO can model var-

ious product portfolios, swap out machines,

or model utilization and schedules to

optimize agility and cost — all using soft-

ware and delivering quantifiable answers

in seconds.

Science fiction? Yes and no. The technol-

ogy exists today — including predictive

analytics, robotic process automation,

and AI-based tools, all digitally connected

via the Internet of Things (IoT) — but no

pharma company has fully leveraged it.

Some companies apply point solutions and

individual tools, but most get stuck in the

pilot phase and struggle to scale up digital

across the enterprise. This approach leads

to limited results that might excite the CIO

but not the CEO.

Why is it so difficult to implement these

tools at scale? You need visionaries — and

not just pragmatists — to see the full

potential of digital. At the same time, orga-

nizations need to manage expectations

and understand the impact will come in

successive horizons, not all at once in the

next budget cycle. Finally, companies need

to think of digital not as a series of individ-

ual tools but as a means of transformation,

requiring technology and people.

THE LESSONS OF LEAN MANUFACTURINGThe lean methodology was invented by

Turning A Buzzword Into Exponential ImpactHow data is changing pharma operations

By Daniele Iacovelli, Thibaut Dedeurwaerder, Parag Patel, Eoin Leydon, McKinsey & Company



Toyota as part of the company’s famed

Toyota Production System. Throughout

the 1980s and 1990s, that system led to

massive success in the automobile indus-

try, with extremely high quality standards

and lower costs, allowing Toyota to dra-

matically increase its global market share.

In response, other car manufacturers —

most notably U.S. companies like Ford

and GM — tried to copy the principles of

lean. Yet, their early efforts were high-pro-

file disasters, in part because they tried

to implement individual lean tools and

processes without having the right organi-

zational elements in place.

This approach was bound to fail. In fact,

the actions of those companies were

almost more disruptive than taking no

action at all. One book, “The Machine that

Changed the World,” recounts this strug-

gle: “Lean-production methods on existing

mass-production systems causes great pain

and dislocation.” It took years for these

manufacturers to realize that success in

lean required more than merely plugging in

some new technical tools or using fancy ter-

minology. Rather, it required a fundamental

rewiring of the organization and manage-

rial system, which led to a cascading set of

implications from the executive suite to the

shop floor.

As with lean, the value from digital and AI

will not come from trying to bolt tools onto

existing processes. It will come through

a comprehensive transformation of the

entire organization. Currently, many pharma

companies are at the earliest stages of

experimentation, still limited to pilot tests,

small-scale digital initiatives, and proof-

of-concept exercises (or, as a recently

McKinsey & Company paper published

in conjunction with the World Economic

Forum termed it, “pilot purgatory”). These

are self-limiting; They will not generate the

kind of dramatic results that leaders expect,

potentially threatening future investments.

If these companies are to take advantage of

digital, they need to think in more compre-

hensive terms, by making systemic changes.

WHY THE FUTURE IS DIFFERENTThis kind of comprehensive approach is

necessary because of five fundamental

shifts in the way pharmaceuticals will be

produced in the future. Collectively, the

shifts are leading to a quantum change in

manufacturing and order-of-magnitude

improvements in processes.

1. Advanced product and process mastery.

First, companies can use new technologies

to better understand how input param-

eters such as machine settings, operator

training levels, or raw material options will

affect quality and outcomes. In practical

terms, companies can build an advanced

analytical model and run historical data

on chemistry, manufacturing, and controls

(CMC) through the model to determine the

impact of individual changes. By mapping



outputs to inputs, companies can proac-

tively optimize all inputs and thus reduce

variations. In addition, by documenting this

level of control over input parameters to

regulators, companies can get rid of testing

and thus cut throughput times in half. This

obviously also boosts efficiencies, as most

of the quality assurance and quality control

tasks disappear.

2. Real-time predictive analytics.

Production managers start their day with

a simple question: What is my biggest risk

right now? Analytical models to predict

critical events can answer this question.

The risks can be deviations, quality issues,

machine failures, or large changes in

demand. Pharma operations executives can

leverage big data, external and internal indi-

cators, and machine learning algorithms to

better forecast demand, and automatically

identify and mitigate supply risks.

3. E2E digital twin simulation

and optimization.

Companies can also build digital simulations

of production processes — on the level

of individual machines, labs, factories, or

entire manufacturing networks (just like the

aircraft example). These real-time digital

twin simulations allow companies to steer

processes proactively by predicting the

effect of adding a new machine, changing

schedules, or changing the team alloca-

tion — all before applying those steps to

physical assets. In this way, the company

can optimize production parameters for

highly complex systems, accurately and

proactively, without risk. This is a signifi-

cant advance in efficiency compared to the

traditional approach of sifting through his-

torical data manually.

How is this different from existing planning

and scheduling solutions? Real-time digital

simulations offer dramatic improvements

in speed and accuracy. “Demonstrated per-

formance” for factors such as lead times

or machine output replaces master data

(which still today is of poor quality in most

companies). Manufacturers can use real-

time AI-based insights to evolve beyond

simplistic rules like “frozen periods,” rhythm

wheels, or minimum order quantities. Com-

panies can run multiple simulations at the

same time, allowing them to plan across

multiple dimensions simultaneously, moving

to multi-echelon planning. All this saves

time and reduces the need for inventory

buffers, so that companies can plan and

sequence runs more effectively while stay-

ing focused on customer requirements.

4. Automation of knowledge work

and robotics.

Finally, tools are emerging to automate and

improve knowledge work and administra-

tive processes. For example, digital robots

can autonomously handle measures such

as supply planning and scheduling, or use

self-learning algorithms to support deci-

sions such as portfolio margin optimization



or corrective and preventive actions

(CAPA). In the case of a product devia-

tion, natural language processing can show

where and what went wrong and compile

this into a Pareto diagram or some other

type of visualization. All these solutions

reduce time — mainly of white-collar work-

ers — and not by 10 percent, but by 90 to

100 percent.

5. Digital operations assistance.

The biggest weakness in pharma produc-

tion is human error. Statistically, tasks

performed by humans are about 92 per-

cent accurate. This is incompatible with

the compliance expectation in pharma.

Therefore, the shop floor is increasingly

digital, powered by new systems that

support operators in daily tasks — partic-

ularly those that are highly repetitive. For

example, tools such as augmented-reality

glasses could show operators the checklist

of steps needed to finish specific pro-

cesses, or confirm that required measures

have been completed, along with gather-

ing and reporting data to fuel analytical

models. Managers could also be given a

tablet-based dashboard with real-time per-

formance KPIs, losses, machine status, and

potential measures to improve. If something

goes wrong — or is likely to go wrong — the

managers receive an alert.

THE BUSINESS CASEPharma supply chains have traditionally

been characterized by long lead times (up

to one year for the median pharma com-

pany)1 and high inventories (250 days).2

And although customer service levels are

relatively high, most companies still spend a

lot of time firefighting and balancing supply

and demand issues.

So, what is the business case for digital?

The technology is in the early stages, mean-

ing any estimate is just that — an estimate.

Yet, McKinsey research suggests that com-

panies aggressively digitizing their supply

chains can expect to boost annual EBIT

growth by 3.2 percent and revenue growth

by 2.3 percentage points.3 This impact

comes from increasing both the efficiency

and the effectiveness of supply chain plan-

ning and decision making. By connecting

the supply chain end to end through real-

time performance feedback and leveraging

data from various sources (including ERP,

MES, and external data), supply chain exec-

utives can generate greater visibility and

improve performance.

Ultimately, digitizing the supply chain cre-

ates a strategic competitive advantage that

boosts the supply chain organization from

an execution-focused function to the center

of business growth.

THREE HORIZONS TO GENERATE SCALECompanies seeking to capitalize on these

shifts typically start by launching small, tar-

geted measures and then scale up across



the organization. We see this process

playing out in three horizons, with increas-

ing gains in productivity and agility as the

scope of projects grows.

In the initial phase — the experiencing hori-

zon — the transformation is about launching

use cases that are high impact but limited

in scope, typically aimed at one specific

unit or process. The objective is to build

up experience and generate momentum.

Even at this early stage, companies begin

to see increases in operational efficiency,

reliability, and agility. For example, based

on recent digital plant transformation cases,

we have seen:

• Reductions in deviations of up to 80%

• Increases in lab productivity by up to 60%

• Reductions in closures due to deviations

of up to 80%

• Increases in OEE of more than 40% on

packaging lines

• Reductions in changeover times by more

than 30%

Once the company has gained some basic

experience, it is time to shift to an exploring

horizon. In this phase, companies launch

“lighthouse” projects that demonstrate the

full potential of a given technology and

serve as an inspiration and innovation hub

for the company as a whole. The scope

covers the entire site, and the company

starts using technology to differentiate

itself against the competition. Typical

achievements in the exploring horizon

include prescriptive analytics (rather than

descriptive), fully standardizing data across

an entire production site, or a suite of

advanced digital assistance to all operators

at the site. It is critical in this phase to use

models geared to value creation. Compa-

nies can expect an additional 50 percent

increase in terms of efficiency, quality, and

flexibility metrics.

Finally, companies can advance to an envi-

sioning horizon, in which digital is rolled

out across the entire value chain. By now,

the organization has predictive machine

learning models in place that can actively

suggest optimization measures. Data is

easily accessible and transparent, including

secure e-validation from end to end. Many

tasks have disappeared (such as testing)

and regulatory and technology changes

are simulated and approved. Advanced

digital assistance tools are in place through-

out all production sites (including those

of suppliers and customers). At an envi-

sioning horizon, companies can register

a 100 percent increase across key opera-

tional metrics.

KEY SUCCESS FACTORSThe reason many companies fall short in

digital transformation is that they focus too

much on the tools and applications, and

not enough on building the right internal

foundation. A truly transformative system

change can only happen if companies have

the conditions in place. To that end, there



are several key success factors that man-

agement teams should focus on.

Invest in capabilities and adjust

the organization

According to some estimates, up to 60 per-

cent of manufacturing tasks can ultimately

be automated by digital. However, that

does not mean that 60 percent of jobs will

go away. Rather, digitization will transform

the way work gets done, scaling back the

need for some positions but creating new

demand for others. For example, data sci-

entists, data engineers, and developers that

specialize in user interfaces will be in high

demand. Already, companies are fiercely

competing for people with these skills,

by launching dedicated internal capabili-

ty-building programs, collaborating with

universities, and revamping degree and cer-

tification programs. Moreover, companies

are redrawing organizational lines to deploy

digital production — for example, creating

cross-functional teams that combine opera-

tions disciplines with IT. Others are realizing

that the elimination of tasks in planning,

analyzing, training, and supervision has

implications on workloads as well as the

required skills of their people, and they are

rewriting job descriptions accordingly.

Apply strong change management

Launching a “digital transformation” can

seem ambitious. But tentative half-mea-

sures will not capture the full potential

from technology. Companies need to apply

strong and deliberate change management

through a comprehensive program that

spans the entire value chain. Moreover,

the transformation will disproportionately

impact the middle layers and white collar

workers in expert roles. Unless you have

a vision and provide support to these col-

leagues — starting with a story that clearly

communicates the need for change — the

adoption of digital will stall.

Consider the perspective of a planner or

process engineer at your company. After

the first successful pilot of automated

planning or AI used to predict batch out-

comes, people in these roles will see that

the processes they have spent years study-

ing and improving can be executed by an

algorithm in seconds, often with greater

accuracy. It is inevitable that the sheer

speed of information flow and transparency

of performance data will create discomfort

for many employees throughout the orga-

nization. Change management — starting

with a change story, a strategic resource

plan, and a reskilling program to build new

cross-functional teams — can address this

discomfort and ensure the overall program

stays on track.

Rethink your approach to IT infrastruc-

ture development

Rather than thinking about IT projects as

multi-million dollar, year-long transitions

without a clear business case, companies

should set up a common platform to



connect all data sources (for example,

through a data lake). The trick to connect

more data in less time? Start with business

needs. Once you have created the data

lake as a foundation, you only create the

two to five percent of connections that

actually matter for the first generation of

use cases. Transformations typically require

20 to 25 use cases before they generate

sufficient momentum. Achieving this level

of connection can take three to six months

using a data lake — not three to four years

as with traditional IT projects. This approach

— also called “agile development” of IT

infrastructure — is obviously a mindset shift

and in some cases may not mesh with the

existing IT roadmap that many companies

already have in place. Unless there is clear

agreement among the leadership team, this

misalignment can quickly lead to delays.

Break the budget cycle mindset

Over the past decade, pharma operations

have focused on reducing waste through

measures like lean and sigma. Those efforts

led to remarkable successes and sizable year-

over-year cost savings — especially given the

low cost of those measures. The downside

is that some companies now have a short-

term mindset. Digital holds tremendous

potential, but it may not deliver gains on a

predictable schedule that can be built into the

budget cycle. Victories will require targeted

investments in areas like IT, automation, and

other technical solutions. Leaders need to

help their teams distinguish between “budget

tightening” initiatives and the investments

needed to get to a digitally enabled future

state. For this reason, some companies have

created separate budgets managed by a

leader with oversight over digital programs.

Digital manufacturing in pharma is not just a

far-flung vision; increasingly, it is the indus-

try’s new reality. Leading companies are

developing a vision and roadmap for imple-

mentation, putting them on track to capture

substantial value via gains in production

capacity and reductions in unit costs. What

is more, they are transforming their orga-

nizations to fully embrace innovation and

position them to compete in a future that

will look very different.

FOOTNOTES1. 228 days API, 75 days formulation, and

41 days packaging. Source: McKinsey

POBOS Supply Chain.

2. Including raw materials, intermediates,

drug substances, excipients, bulk pack-

aging materials, and finished goods at

plant, in-transit, and country distribution

centers.

3. J. Bughin, L. LaBerge, and A. Mellbye,

“The Case for Digital Reinvention,” McK-

insey Quarterly, February 2017.



In 2010, the industrial world changed,

probably forever. The first cyber weapon,

called Stuxnet, fashioned specifically to

compromise industrial automation equip-

ment was turned loose on the world of

manufacturing. Stuxnet crossed the bound-

aries of IT infrastructure and moved into

industrial automation. It, and soon-after

other worms, compromised programmable

logic controllers (PLCs), collected infor-

mation on industrial systems and changed

programming to deliberately damage the

connected equipment. This was an alarm

bell, but few managers had any idea of how

to respond.

Today, process manufacturing in gen-

eral and the pharmaceutical industry in

particular are seeing increasing num-

bers of cybersecurity threats. To protect

themselves, companies have to change the

way they operate by addressing cyberse-

curity threats and designing appropriate

defenses. Pharmaceutical companies have

to recognize their high visibility and attrac-

tiveness as targets. They must work to

understand cybersecurity concepts, identify

weak points and implement appropriate

security measures.

Process automation systems used to be

considered safe. They were proprietary and

isolated from external networks, effectively

cutting off any attack vectors. This isola-

tion didn’t last as companies established

connections to IT networks to provide

remote access by management. Often this

provided a path all the way to the inter-

net. Security-by-obscurity and air-gapped

defenses quickly faded away due to a lack

Boosting Cybersecurity in PharmaAppropriate defensive measures are key to protection, starting with a security risk assessment

By CheeHoe Lee, Yokogawa Electric Corporation



of effectiveness. The wide-scale introduc-

tion of the industrial internet of things (IIoT)

is and its fully connected factory concepts

is tearing down any remaining isola-

tion protections.

NO SINGLE CURE-ALL SOLUTIONA bank’s customers expect their money to

be protected. Not only does it lock its vault

and office doors to protect physical assets,

it also has to protect customer data and

financial information. These require different

methods of protection, so a multifaceted

defensive strategy is necessary. Similarly, a

connected pharmaceutical operation must

use appropriate methods to protect its

physical and digital assets.

Different types of assets require different

methods of protection and there should

be multiple layers of protection. That’s the

logic behind defense-in-depth security.

It assumes any single layer of protection

can and likely will be defeated, and thus

uses multiple layers of protection. How

these are conceived and implemented has

to be driven with appropriate authority to

be effective.

A TOP-DOWN APPROACHAll companies make some type of secu-

rity efforts from locking the office door to

having a password on a computer. Compa-

nies large enough to have basic IT services

will implement various cyber protections,

inadequate though they may be. Such is

not always the case for manufacturing

systems, also called operational technol-

ogy (OT). This is considered a different

world and consequently treated differently.

StrategicPolicy

Commitment Leadership

Organizational Responsibility

Audit Responsibility

Procedures

Policy

Monitoring Controling Optimizing Reporting

TacticalProcedures

Site 1 Site 2

Operational Work

InstructionsSystem A System B System C System D System E

Help Desk Infrastructure

Figure 1: A cybersecurity program must span the entire organization, with strategic leadership and policy provided by upper management.



Security-by-obscurity concepts are often

still used whether they are valid or not. Not

all senior managers understand this second

world or how to protect it, often resulting in

insufficient resources and budgets.

To secure the necessary support, a top-

down approach is necessary, driven by

senior-level managers using risk-based

methodology. The strong upper manage-

ment support must be supplemented by

dedicated champions and defined funding

under a clear implementation process. The

top layers of the organization deal with

strategy, risk and governance while lower

levels deal with operational tasks (Figure 1).

Bottom-up approaches alone rarely suc-

ceed in the long term. They may help

address point issues or specific weaknesses,

but they can’t reach far enough to take the

bigger picture and root causes into account.

The preferred methodology is to align a

top-down approach with its emphasis on

planning with a bottom-up approach to the

daily work that must be done to implement

a sustainable cybersecurity program.

CONDUCTING A RISK ASSESSMENTA cybersecurity program extends far

beyond installing firewalls and anti-virus

software. Cybersecurity programs for the

IT or OT domains should be embedded

into the company’s business processes at

multiple levels. One proven cyber secu-

rity program methodology embraces the

FARM approach:

• Frame—Defines scope

• Assess—Measures risks

• Respond—Outlines responses to

threats, and

• Monitor—Ensure continued effectiveness.

The assessment step determines the current

security and maturity level of the plant and

OT networks. It derives baselines for the

protections implemented in the response

step, and maps any gaps against the

industry’s and the individual company’s pro-

tection level.

ASSESSMENT TOOLSProtection level analysis provides a useful

assessment yardstick. It is a two-sided

technical measure to quantify the state of

Protection Level

4 D+ C+ B+ A+ PL D Protection against casual or coincidental violation

3 D C B A PL CProtection against intentional violation using simple means with low resources, generic skills and low motivation

2 D- C- B- A- PL BProtection against intentional violation using sophisticated means with moderate resources, IACS specific skills and moderate motivation

1 D- C- B- A- PL AProtection against intentional violation using sophisticated means with extended resources, IACS specific skills and high motivation

1 2 3 4



individual elements of a cybersecurity pro-

gram. The protection level is derived from

a combination of the security level, which

can be provided by technical measures, and

the existing maturity level of organizational

measures. Let’s unpack this concept.

The security level (SL) is based on

the requirements and represents the

achieved protections available with the

automation solution’s technical capabilities

as determined by the assessment. The

maturity level (ML) is inferred by the

procedural capabilities of the plant

or facility personnel. It is potentially

associated with technical capabilities, such

as administration of password policies

enforced by automated login and account

management software.

Consider an example: A small produc-

tion unit is built around a bioreactor and

its ancillary equipment. The process is

controlled by a PLC programmed with

the recipes and procedures to make the

range of products produced in this biore-

actor. When assessing this unit, it will be

necessary to see how well protected the

PLC is from threats coming through the

plant network or other possible attack vec-

tors. A low security level suggests it is very

easy to extract information or reprogram

the PLC. A high security level says it cannot

be accessed without appropriate authoriza-

tion, authentication, etc.

Maturity reflects more on how individuals

understand company policies and interact

with the control components and equip-

ment. A low maturity score suggests sloppy

practices such as writing the password for

the PLC on the cabinet, or no password at

all. A high maturity score indicates workers

are methodical about following established

procedures, and understand the impor-

tance of what they are doing and how

their actions can support or hinder secu-

rity efforts.

During the assessment process, security

level and maturity level values are used as

the axes of a four-by-four matrix, and a pro-

tection level value is assigned to each cell

in the matrix. The protection level relates

Based on this assessment, a security

framework can be established along

with policies and procedures.



the achieved security level of the technical

measures with the related organizational

measures (Figure 2). Therefore, achieving a

high protection level requires a high protec-

tion and maturity level.

ASSESSMENT RESULTSAt the end of the cybersecurity risk assess-

ment, the team produces a comprehensive

risk assessment report, a threat catalog and

a risk treatment plan. Based on the findings

of this assessment, a security framework

can be established along with policies and

procedures. Policies are guiding principles

for a variety of functions:

• Set direction in an organization

• Outline security roles and responsibilities

• Define the scope of information to be

protected, and

• Provide a high-level description of the

controls that must be in place to protect

the OT domain

Policies make references to standards and

guidelines. From a legal and compliance

perspective, a policy is considered as a

commitment from senior management

to implement the program throughout

the organization.

Standards help ensure security consis-

tency across the business and the use

of best practices. However, companies

should be vigilant to ensure they do not

become merely guidelines to be applied

when convenient.

Procedures describe how each policy will

be put into action in the organization, and

describe how something is accomplished.

Procedures describe who, what, where,

when and why by means of establishing

corporate accountability in support of a

policy. The description is related to the

work processes and not to specific techni-

cal solutions. The output of a procedure is

an input to a work instruction describing

how to perform a certain task, which is a

more detailed portion of the procedure, and

often solution- and role-specific.

PROTECTING INDUSTRIAL CONTROLS WITH THE RIGHT TOOLSThere are many different types of

components, some visible or others behind-

the-scenes, within an industrial automation

system network. A typical pharmaceutical

manufacturing setting involves multiple

PLCs and distributed control systems

(DCSes) controlling batch processing of

various compounds.

The PLCs and DCSes control the low-level

equipment: setting parameters, managing

I/O, opening and closing valves, etc.

Let’s say the PLC running a process per-

forms flawlessly 99 percent of the time.

Those trying to understand and fix the 1

percent failure may assume there is some-

thing wrong with the process and waste

much time trying to find the root cause.



On the other hand, cybersecurity monitor-

ing tools might recognize the failure was

caused by a network incident resulting

in a PLC misconfiguration, for example a

network traffic jam caused a momentary

bandwidth shortage resulting in dropped

I/O commands.

Looking at such a situation from a cyber-

security perspective, a hacker aware of

the incident might look for ways to repli-

cate this issue by causing a domain name

system (DNS) attack which would disrupt

various processes, resulting in lost batches

or worse.

IMPLEMENTING BEST PRACTICES FOR INDUSTRIAL SYSTEMSA common problem today results from

senior C-level managers trying to manage

data security using tools and solutions

designed for IT systems. They’ll direct the

team to install firewalls, anti-virus tools and

automated network patching. The CIO or

other high-level executive can’t dive into

the details of security risks in complex man-

ufacturing environments. The IT and even

OT networks may have sufficient cyberse-

curity protections, but not the PLCs and

DCSs actually controlling the processes.

The CIO might think everything is buttoned

up because their anti-virus platform is up to

date, but this often ignores the OT side.

Protecting the OT side often depends on

a solution able to detect anomalies within

industrial networks — a tool to monitor the

PLCs and DCSes that aren’t part of the typ-

ical corporate data network. Armed with

such a platform, engineers, control system

operators and network security staff can

have control over various threats with-

out restricting the facility’s productivity

or performance.

Ideally, such a solution continuously iden-

tifies and analyzes deviations from the

norm, so a pharmaceutical manufacturer

can eliminate risks to its IP and actual

product integrity. Additional context and

insights come from such a solution in terms

of how it relates to other systems concur-

rently operating within the manufacturing

plant. This type of solution gives meaning

to the other system by providing guidance

on what firewall rules should look like and

sending alerts when firewall functions are

out of baseline.

MANAGING THE SECURITY AND OPERATIONAL SIDESSome cybersecurity solutions only provide

protections and insight for the network,

but do not offer views into design flaws

or misconfigurations within the actual

production equipment. Returning to the

1 percent problem example with the PLC,

an advanced industrial control monitoring

solution provides this extra layer of

insight so network managers can catch

and stop small problems from becoming

costly catastrophes.



The implementation of such a solution is

critically important. When interfacing with

the environment to create a monitoring

point, the software will capture data from

the network, but it must not create traffic

itself. The solution is not hindering net-

work communications, it is instead simply

listening to the traffic and checking all of

the proprietary systems and protocols. The

objective is quick detection and remedies.

Even if a company can achieve an appro-

priate security level by introducing security

measures into the different domains, the

security level will decrease every day

because new malware is constantly being

created. Maintaining cybersecurity is a

dynamic and never ends. It must be part

of a sustainable security lifecycle sup-

ported by effective tools and constant

reassessment.



2018 Smart Pharma - Pharmaceutical Industry

Documents

Transcript of 2018 Smart Pharma - Pharmaceutical Industry