PGP Glass tackles OT, IoT convergence

The manufacturing industry is a prime target for cyberattackers. Last year, 80% of manufacturing firms saw a significant increase in security incidents, according to data from research firm Omdia.

OT cybersecurity provider Dragos also noted an 87% increase in ransomware attacks against industrial organizations, with manufacturing the hardest-hit sector. And, of the incidents that Dragos responded to in 2024, 75% involved a partial shutdown of operational technology, and 25% led to a full shutdown.

Meanwhile, the industrial sector also saw the biggest increase in the cost of an average breach, according to IBM, because manufacturing organizations are highly sensitive to downtime. Last year, the average breach cost manufacturing firms more than $6 million, an increase of $830,000 compared to a year earlier. Plus, the average breach took 199 days to identify and 73 more days to contain, IBM reported. This is higher than the average for all industries, which is 194 and 64, respectively.

PGP Glass didn’t suffer a breach, but these statistics were top of mind when the company was modernizing its OT and IoT infrastructure.

A crisis of complexity

PGP Glass is a growing global glass packaging company headquartered in Mumbai. It has more than 70 production lines in facilities in India, Sri Lanka, and other regions, more than 3,500 employees, offices in 25 countries, customers in 80 countries, and 14,000 different SKUs. It produces 1,730 tons of beverage, perfume, pharmaceutical and other bottles every day.

“We grew double in the past three years in terms of the top line,” says Sudip Mazumder, the chief digital and information officer at PGP Glass. “We’re expanding in the Middle East, in North America and Latin America, and in the southern European countries.” On top of the growth, the company also faced pressures to cut production costs and reduce energy usage.

In response to these needs, PGP Glass initiated a significant digital transformation in 2017, and the changes accelerated after it was acquired by Blackstone in 2020.

“We have to support the business, its strategic business goals, and more and more systems – and more and more modern systems,” says Mazumder. “Like it or not, AI is the order of the day and we have to use it. People expect AI and ML on the shop floor to get more efficiency. We need to have generative AI because employees expect it. And it’s all happening at the same time.”

But the AI and ML platforms that bring in better efficiency need data, which requires more sensors and more data feeds from the manufacturing machinery and other factory devices. For example, there’s one system that collects imaging data and another that collects information from the manufacturing machines.

“There are two core IoT platforms there, and all our critical machines are connected at all the manufacturing facilities,” Mazumder says. “And we have energy monitoring and energy meters everywhere. We are a glass manufacturing company, and 20% of our input costs are energy costs. It’s very important for us to monitor energy consumption in near real-time.”

Most of that is now from renewable energy sources, he adds, since the company has reduced its fossil fuel consumption significantly.

Still, efficient use of energy is important. That requires IoT devices to collect the measurements and AI and ML systems to do the analysis, he says. That results in 12,000 sensors just for the energy measurements.

Each year, PGP Glass shoots for .5% to 1% efficiency gains, and between 1% to 2% for reductions in energy use. That adds up to between $2 to $3 million in savings.

But all of these new systems expanded the attack surface and created new attack vectors, Mazumder says.

Prior to 2017, before the company’s Industry 4.0 transformation, management was largely based on old-fashioned, paper-based processes.

After that first push, PGP Glass deployed two different management platforms, an IoT product based on Azure that’s since been acquired by Deloitte, and an energy management product hosted on AWS from a startup.

To secure these systems, PGP Glass deployed data security for the databases, tapped the security features built into the sensor management applications themselves, and added other tools.

The problem is that most cybersecurity systems are designed for IT, says Amit Jha, the company’s general manager and global head of IT and cybersecurity.

“But we’re in manufacturing,” he says. “We have manufacturing engineering systems, we have SCADA [supervisory control and data acquisition], we have PLCs [programmable logic controllers], we have CNCs [computer numerical controllers]. These systems were not designed from the security standpoint.”

These systems were, in the past, not typically exposed to the kind of threats that IT systems were exposed to, he says. But that all changed with Industry 4.0.

“In other industries, if something is compromised, they may just switch it off,” Jha says. But manufacturing is PGP Glass’s core business. These industrial machines can’t just be switched off. “We would still want to keep it on because that’s what’s core for us,” he says. “That’s what’s core for our survival.”

At this point, PGP Glass was able to have good visibility into its IT systems, but nothing closely monitoring the security of the manufacturing systems. “If you cannot see something, you cannot control it,” Jha says.

There were other security systems in place that covered the company’s perimeter, but nothing granular. Then, four years ago, after the acquisition by Blackstone, PGP Glass had to migrate all its systems anyway. “We had to get ourselves carved out from the previous business and had to get ourselves segregated and build an entirely new IT landscape,” says Jha.

That creates an opportunity to start from scratch with cybersecurity, as well. “We picked an industry-leading framework and started getting ourselves aligned,” he says.

That framework was ISO 27001, an internationally recognized standard for information security management. The company also wanted to comply with Europe’s Ecolabel standard, which has a cybersecurity aspect, he says.

“We had to look at our policies, our procedures, and our controls,” Jha says. “We started by looking at our perimeter security, access security, then data security, then application security, then on-prem, then Azure, and AWS. All these entities need to have levels of security and controls. Then we looked at the OT systems, where we had lots of gaps. We were able to make good progress on the IoT front – but not on the OT systems. We still didn’t have something for OT.”

The manufacturing machines were now generating data that was moving out through IoT devices, through gateways, and out to the cloud, says Mazumder. But while this channel was protected by perimeter security, there was no internal monitoring for, say, a particular gateway or a particular PLC.

So, in early 2023, PGP Glass began looking for security platforms that could provide all the OT monitoring the company needed. “We wanted to have that,” says Mazumder. “We wanted to see how the OT devices were secured, to monitor them so that there was no intrusion there, to see that nobody was intruding into the gateways.”

In the summer of 2023, the company settled on two finalists and ran a proof concept test. The winner, Armis Centrix, had the biggest database of manufacturing equipment. “The larger the database, the higher the probability of the device being discovered,” says Jha. Otherwise, there might be some machines in the environment that don’t get picked up by the monitoring system.

“We started with Armis as a tool for discovering and monitoring equipment, and are now looking at them for asset management,” says Jha. “It also shows us not only what kinds of devices are connected, but also whether they’re part of the PGP Glass domain.”

Another benefit of the Armis solution is that it is completely agentless, he says, so there are no performance issues. “It’s an appliance that sits on the network.”

The rollout took place in phases. In October 2023, Armis was deployed at one plant in India, then at another plant. “Then we monitored it for a few months,” says Jha.

After collecting all the feedback and user experience, it was slowly rolled out to other locations. Today, the company is about two-thirds of the way through the deployment process. “Right now, we’re going ahead with Sri Lanka,” he says. “Then it will be followed by the U.S., France, and Dubai. We expect to be fully done in the next six to nine months.”

In addition to installing the Armis appliance, PGP Glass also needed to make some minor changes to its network design and architecture to ensure that it was able to use the tools as efficiently as possible. The company also engaged cyber risk and security consultants from Wipro to help with the rollout and implementation.

The great convergence

The gap between IT and OT is rapidly eroding away in companies around the world, and at PGP Glass as well. But most companies lag behind when it comes to securing both sides of the technology.

According to Omdia’s survey of over 500 technology executives in the manufacturing industry, 86% of firms feel that IT and OT integration is important to their business, with half of companies reporting IT/OT convergence last year, and an estimated 70% expected to achieve it this year.

Meanwhile, 31% reported incurring financial losses last year as a result of a security incident – and 75% of the attacks started out on the IT side, not in OT. In addition, 62% of manufacturing firms faced issues with resilience or availability, with a typical incident costing between $200,000 and $2 million.

However, most organizations are at a developing or operational level when it comes to securing their converged IT and OT infrastructure, with only 19% in the advanced category, meaning that they have IT/OT-specific automation tools, processes, and platforms – and continuous, consistent threat assessment, and rededication and recovery processes and procedures.

With Armis, PGP Glass moved up when it comes to IT/OT convergence maturity scale.

The data from IoT and OT devices that feed the unified energy monitoring system and a real-time manufacturing intelligence system flows into Armis and then into other tools, such as the company’s endpoint detection and response platform and its security information and event management system.

The Armis platform even discovers and pulls in data from external devices, such as mobile phones used by executives and visitors who connect to the corporate network. The platform also serves as the configuration management database for all types of devices, including IT and mobile.

As a result, PGP Glass now has one of the strongest security postures in the Blackstone family, says Mazumder. “We are one of the leading players in their portfolio.”

“And we can sleep better at night,” he adds.

The bottom line

The company did not disclose the total cost of the Armis solution, but said it was able to sunset redundant tools from the network due to Armis’ broader capabilities. “And despite having a larger attack surface, we’re still able to maintain a higher level of compliance and security posture,” says Jha.

This also translates to lower cybersecurity premiums. Last year, cybersecurity premiums went down between 40 and 45%, says Jha. But that’s not the biggest benefit, says Mazumder.

GPG Glass is one of the premier premium glass bottle manufacturers for perfumes, food and beverages, pharmaceutical, and cosmetics, he says. “If you think of a global name, they’re most likely our customers.”

“The cost of security is a finite cost,” he says. “If there’s a breach, there’s a potential infinite cost in terms of the reputation of the company.”