What is ransomware resiliency and how to obtain it

Ransomware

By Perpetual Storage

Ransomware – ran·som·ware – a type of malicious software designed to block access to a computer system until a sum of money is paid.

Resiliency – ri-zil-yuh n-see –  the power or ability to return to the original form, position, etc., the ability to recover readily

The ever-growing threat of ransomware over the past few years has IT professionals adding additional security controls. The only protection from a ransomware attack is to prevent it. This is why ransomware resiliency is so important to all organizations.

Ransomware Resiliency is multi-dimensional. It requires security awareness, technological solutions and human vigilance. Your organization must have a comprehensive plan that is embedded in the culture to withstand a ransomware attack.

Here are just a few ways you can increase your organization’s ransomware resiliency:

  • Back up data – 3-2-1 backup rule!
    • Original plus 2 copies
    • Two different backup types
    • One copy offsite
  • Keep your software up to date
  • Do not leave applications (Dropbox, Google Drive, OneDrive etc.) open. Sync data and close
  • Adjust browser privacy and security settings for increased protection
  • Use a reliable antivirus product that includes an automatic update module and a real-time scanner
  • Never open email from an unknown user
  • Do not open attachments or click on links in suspicious or spam email

Finally keep this in mind, a resiliency plan is useless if no one knows what to do with it. And, ask yourself “what are the financial consequences of losing your organization’s information services”?

Ransomware brought extortion to a global scale, and it is up to us, users, business-owners and decision-makers, to disrupt it.

Originally posted here

Perpetual Storage, Inc. (PSI) is a climate controlled vital records storage & maximum security vault and datacenter located inside a solid granite mountain near Salt Lake City, Utah. PSI provides disaster recovery, backup and long-term storage services for both physical media and digital data in a facility that was built to exceed Department of Defense standards. It is one of the most established, cutting edge and safest off-site storage facilities of its kind in existence. PSI’s services are available 24/7/365. It has been privately owned and operated for over 49 years and is a certified ‘Woman-Owned Small Business’.

 

Who are we & how to engage with us

By Maureen Brakke, Marketing & Communications

Who are we?

The University of Utah Manufacturing Extension Partnership (MEP) Center is the MEP Center for the state of Utah. We launched in October 2016.

MEP history

Our partners

Our funding partners are the Governor’s Office of Economic Development and the federal government through the National Institute of Standards and Technology (NIST)-MEP Network. The University of Utah also hosts the MEP Center on campus. Learn about our service-delivery partners, economic development partners, and industry partners.

What we do 

Our mission is to provide Utah manufacturing companies with services and consulting to increase their global competitiveness. We do this through growing and retaining jobs, cost savings, and increasing sales and investment.

What does that mean?

This means that if a Utah manufacturing company needs help with project, staff training, certifications, best-practices in manufacturing, product/process innovation, troubleshooting, or wants to grow into new markets, we can help.  View our success stories to see how we have worked with clients.

How we engage with you

DISCOVER PROPOSE IMPLEMENT MEASURE SUPPORT
We meet you on-site to discuss your company’s needs and assess areas of opportunity. Receive a project proposal with a statement of work describing project scope and cost. Work with our team as we perform and manage the implementation process. Review our project outcomes, report results, and submit feedback to us. Monitor your success and provide ongoing follow up. We aim to develop a lasting relationship with all our clients.

What are the benefits of working with us?

  • We are the trusted advisor and one-stop-shop for manufacturing in Utah.
  • The Utah MEP Center is part of the MEP National Network and leverages the knowledge-base and resources of the entire network to benefit Utah manufacturers.
  • We offer a complete suite of operational excellenceworkforce trainingadvanced manufacturinginnovation, and investment services, and leverage government funding to provide clients with affordable solutions.
  • We find the right solution for each project, either through our own expert staff, or through an MEP Center partner, and always manage each project from start to finish.
  • We follow-up on each project after completion, and keep in touch to provide continuous support.

Next steps 

For any manufacturing project or training needs, call us at 801.587.0713 or email us at info@mep.utah.edu

Support us

Help us spread our message and support us by following us on Twitter, Facebook, and LinkedIn, and sign up for our quarterly newsletter. 

Maureen Brakke works in marketing and communications for the University of Utah MEP Center. She previously worked for the Utah System of Higher Education in marketing and communications, managing multiple initiatives, brands, blogs, and websites. Connect with her on Twitter.

Thrive Life obtained SQF certification and gained $700,000 in new manufacturing contracts

Thrive Life, LLC is a premier source for healthy, convenient, and cost efficient freeze dried food. There are over 40 steps in their proprietary freeze dry process to make sure the taste, quality and nutrition are exactly how people describe it: amazing! 

Project Scope

Thrive Life wanted to obtain their Safe Quality Food (SQF) Certification in order to attract new clients and increase sales.

Solution

The University of Utah Manufacturing Extension Partnership (UUMEP) Center staff worked with Jenny Swingle, Director of Strategy, to support their preparation for their SQF audit.

Results

Thrive Life successfully obtained their SQF certification.

Impact

By obtaining their SQF certification, Thrive Life was able to secure $700,000 in manufacturing contracts within the first two months of certification, and will save over $10,000 in annual insurance expenses moving forward.

Client testimonial

“Working with the Manufacturing Extension Partnership (MEP) at the University of Utah has taken away a lot of the financial and administrative stress from pursuing growth initiatives. They truly feel like a business partner interested and invested in our success. Their staff took the time to personally evaluate our business needs and opportunities to see how their experience and resources could improve our operations. They also provided extensive administrative support required for contract negotiation, project savings, and payment processing. The UUMEP Center is organized, responsive, and has a great team of experienced staff.”

Jenny Swingle, Director of Strategy

Check out their website to purchase their products.

Download PDF of success story

The background on industry cybersecurity standards: NIST, CSET, DFARS

By Cytellix Cyber Blog for Small Businesses

How to best understand the Cybersecurity guidance and volumes of information is an ominous challenge? The foundational cybersecurity work produced by NIST (National Institute for Standards and Technology) is a comprehensive cybersecurity review. Rather than diving too deep in to NIST and the regulatory nature of the definition of classified vs unclassified information and its protection, we will touch on the value of measuring a commercial organizations cybersecurity posture.

The recommended NIST standards, should you be interested to read, are noted as NIST SP 800-171, published October 18, 2015 identifies a couple very useful tools and premises for measurements. One tool, that is very useful is the CSET (Cyber Security Evaluation Tool), which is a self-test, that any organization can use for “free.” While this tool is comprehensive in nature, it does require the user of the tool, to have an in-depth IT and Cyber background to accurately answer the 109 technical questions.

The second very useful part of the NIST publication is the breakdown of measurements into the specific 14-controls: Access Control, Awareness and Training, Auditing and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communication Protection, System and Information Integrity. By accurately measuring these controls in both a self-test environment (CSET) and using network scanning/situational awareness tools, an organization can get a true grade of their cybersecurity posture to uncover looming vulnerabilities.

The tool (CSET) produces a private result that are defined as a percentage out of 100%, with 100% being equal to compliance. The commercial customer can be measured against a publicly available industry standard, that has been architected to look at a company’s posture without bias. The meaning is to use an industry standard, and by definition, an industry standard is not proprietary. The consulting, technology and solutions market typically use a proprietary methodology to assist in assessments. However, leveraging the standards will give your organization a measurable outcome and baseline for improvements.

Now that we have reviewed the foundations, putting this into practice and having a vision of the effect on your company is an important discussion. Today, any organization, that supplies the federal government with product, solutions or services under a DOD contract, MUST BE COMPLIANT BY 12/31/2017. This date is non-negotiable. Organizations can self-assess or outsource the entire process to cyber experts. There are a few other requirements for compliance beyond providing the 100% System Security Plan, which include a Plan of Action and Milestones (your cyber improvement plan), a gap analysis (what are my company challenges), continuous monitoring and cyber incident reporting processes. The commercial market cyber need is increasing daily, with both compliance, business continuity needs and basic preparedness. The standards approach is a very good methodology and starting place.

Other industries that will see changes for compliance in variations of this standard include: Healthcare, Financial Services, Food Safety, manufacturing and the Small and Medium Businesses (SMB’s). Here are some great references to see where the future of Cybersecurity preparedness is heading.

DFARS 252.204-7012 referenced as contract language for federal NIST 800-171 – designed for non-federal information systems (commercial)
NIST 800-53 cybersecurity framework for Federal information systems
Cybersecurity Framework for critical infrastructure – references NIST 800-53
Health Care Industry Cybersecurity Task Force recommends NIST Cybersecurity framework

Blog originally appeared here.

Contact the University of Utah MEP Center today for a one-hour business cybersecurity discovery session, or call 801.587.0713.

The value of a proactive, structured project management

By Shyamkumar Narayana, PMP

Imagine that you have been given the responsibility of managing a client’s $5 million software-maintenance project. As you start going to on-site meetings, you see that the client lead is speaking without any particular agenda or business objective in mind. Furthermore, nobody is taking notes, so action items aren’t being created, progress is not being tracked, and no meaningful follow-up reports are being shared with team members.

The structure seems fluid at best, so people walk away from the meeting confused about next steps. They either decide for themselves what to work on or don’t do anything at all — and nobody is taking any real ownership of tasks. Because of the ambiguous roles and responsibilities, any issues identified along the way can’t be resolved in a timely manner. Likewise, the poor communication causes the project to experience outcomes that aren’t tied to its true purpose. Time, talent and money all are wasted.

On the other hand, structured project management describes a state in which the project manager clearly defines the team structure, the list of stakeholders and decision makers, and the channel of communication to be used. The meeting cadence, project logistics and reporting methods are planned early on. Everyone involved knows their roles, when they need to make updates to the project plan and the time to provide status reports. Risks are considered thoughtfully and mitigated. The budget is reported to stakeholders appropriately so the most effective decisions possible can be made.

Now, let’s return to our software-maintenance project example. Lucky for the client, you are a proactive project manager who knows when it’s time to step in. You begin by establishing a rapport with the team members. Strong listening and communication skills make it possible to positively influence the stakeholders and help them focus on the common goals of the project. You then come up with a game plan for supporting the initiative with a solid project management structure. Next, you discuss that strategy with the stakeholders in order to get buy in. You present them with a cost-benefit analysis. Once the client team understands its results, you coach them about the different aspects of project management. These talks involve scope, issues and risk, meeting minutes, effective follow-up actions, and lessons learned.

Things begin to turn around. People now are keeping business goals in sight. The initiative is planned, monitored and controlled to ensure that tasks are being accomplished on time and within budget. Progress, problems and risks are communicated and effectively managed. Resources are maximized to ensure efficiency. Pretty soon, your client is taking its first meaningful steps toward what turns out to be a very successful project — an excellent result due to a truly proactive approach. 

Originally posted in APICS on August 30, 2017

Shyamkumar Narayana, PMP, is CEO of Thariyiltech Consulting Services, a provider of information technology and staffing solutions. He may be contacted at nshyamk@att.net.

5 robotic essentials for small and mid-sized manufacturers

By Craig Tomita, Area Sales Manager, Universal Robots

For small to mid-sized manufacturers, any gain in productivity can have a huge impact. Automation offers significant advantages, but many small and mid-sized businesses (SMBs) believe that robotics is out of their reach. These organizations can’t afford large, complex robots that don’t fit within their limited floor space, that require specialized personnel to program and maintain them, and that are simply too expensive, with a payback period that is too long to justify the investment.

The new generation of collaborative robots (or simply “cobots”) is changing the game for smaller manufacturers, helping them compete more effectively, offering new opportunities for employees, and even improving worker safety. Look for these 5 essential requirements:

1.     Quick set-up

Setting up a conventional industrial robot can take days or even weeks. That’s time and disruption that SMBs simply can’t afford. When you’re ready to automate, you or any untrained operator need to be able to unpack your new robot, mount it, and begin programming simple tasks in a matter of hours. Collaborative robot arms, such as those from Universal Robots (UR), weigh as little as 11 kg (24.3 lbs), and can be set up in less than a day.

Shane Strange, automation and integration specialist with faucet maker RSS Manufacturing and Phylrich in Costa Mesa, CA, had this experience: “Once [the UR robot] actually hit the floor, we got it unboxed and found a stand for it, and within 45 minutes we had it up, powered, and were actually programming the robot, doing simple back-and-forths and pick-and-place.”

2.     Easy to program without special skills

Most SMBs don’t have a robotic programmer on staff—and can’t afford to hire one. But innovative new robotic technology lets operators with no programming experience quickly program robotic movements based on logical process steps and using intuitive tools. When electronics manufacturer Scott Fetzer Electrical Group in Nashville installed a UR robot, line lead Sebrina Thompson found that “If you can program a smart phone, you can operate this robot.”

3.     Collaborative and safe, even in small shops

Conventional industrial robots require a large, separate enclosure, which adds cost, takes up operational space, and reduces flexibility on the production floor. Management also has to be concerned with the safety risk if someone manages to get inside the enclosure while the robot is activated. But small manufacturers can’t afford to dedicate large areas to robotic operation. Today’s collaborative robots can work side-by-side with human workers in complementary operations. For example, the innovative force-sensing technology built into UR robots means the robot stops operating if it comes into contact with a human, a vast majority of the thousands of UR robots in operation worldwide work right beside human operators with no safety guarding (after risk assessment).

Robots can take over repetitive, injury-prone jobs and improve worker safety, even in limited manufacturing spaces. Richard Clive, machine operator with shelving manufacturer Etalex in Montreal said, “With the Universal Robot arm now I would say it’s at least a 100% safer. Before you had to put your hands close to the break press… and an accident could happen at any time. With the Universal Robot, there’s no chance of anyone getting injured.”

4.     Flexible deployment for multiple uses

Dedicated industrial robots can limit small and mid-sized manufacturers who often have small production batches and require fast change-overs. In contrast, new collaborative robots are lightweight, and easy to redeploy to multiple locations without changing the production layout. And with the ability to reuse programs for recurring tasks, they support agile manufacturing processes with minimal set-up time and effort.

Matt Bush, director of operations for electronics manufacturer Scott Fetzer Electrical Group in Nashville was challenged by how to create a mobile robotic workforce when faced with the need for traditional safety enclosures. Mounting collaborative Universal Robots on wheels solved the problem. “When our workers come in in the morning, their task is no longer to do some monotonous task. It’s to go take the robot and deploy it to whatever job it needs to do that day.” With a similar strategy, Joe McGillivray, co-owner of injection molder Dynamic Group in Minneapolis said, “We’re able to quickly redeploy these robots to completely new tasks in very short order. We have most of them—all of them actually—on bases that we can transport around on wheels and slide them from press to press and application to application. That’s been hugely beneficial to us.”

5.     Fast payback of your investment

Of course, any automation investment for a small or mid-sized manufacturer must pay for itself as quickly as possible. Collaborative robots give you all the advantages of advanced robotic automation, with none of the traditional added costs associated with robot programming, set up, and dedicated, shielded work cells. And with an average payback period of typically just 2-8 months, robotic automation is finally affordable for small and mid-sized manufacturers.

Hal Blenkhorn, director of manufacturing for medical device manufacturer Tegra Medical said, “We’ve had great financial success with the implementation of these robots, to the tune of what we’re seeing on average for the return on investment of between 3 and 6 months. And we were looking at cost, ease of implementation, and ease of use and the Universal Robots seemed to have nailed it in all those areas.” Dynamic Group’s Joe McGillivray said, “When we first started looking into automation, I was surprised to find that we could afford a six-axis robot, and a collaborative one at that. I assumed those robots cost hundreds of thousands of dollars. The return on investment on our initial system was less than two months.”

Want to learn more? Download the free ebook “How to Get Started with Cobots in 10 Easy Steps”:

Craig Tomita has spent the last 30 years in factory automation, robotics, and machine vision. He was formerly the vice president of IAI AMERICA; and has worked in various managerial positions including COGNEX, BOSCH-REXROTH, MINARIK, ADEPT TECHNOLOGIES, and most recently, FESTO.  Craig is now responsible for managing the distributor sales channels of Universal Robots in the western part of United States and Canada. He is a graduate of the University of Southern California.

Preparing for the new age of cyberrisk

By Abe Eshkenazi, CEO, APICS

Malware has crippled banks, railway systems and power companies, but the Associated Press (AP) reported last week that manufacturers increasingly are the victims of cyberattacks too.

Emery P. Dalesio writes about AW North Carolina, a transmission plant that makes parts for nine Toyota car and truck factories across North America. Last August, malware came into the plant through an email and spread like a virus. The criminals threatened to lock up the production line until the company paid a ransom.

AW North Carolina, like many other modern factories, uses just-in-time manufacturing. Therefore, for every hour the plant was shut down, it would have lost $270,000 in revenue. “Production lines that integrate computer-imaging, barcode scanners and measuring tolerances to a hair’s width at multiple points are more vulnerable to malevolent outsiders,” Dalesio writes.

AP interviewed John Peterson, AW North Carolina’s information technology manager. He said the hackers know production schedules are strict. “There’s only a day and a half of inventory in the entire supply chain,” Peterson said in the article. “And so if we don’t make our product in time, that means Toyota doesn’t make their product in time, which means they don’t have a car to sell on the lot that next day. It’s that tight.”

Peterson and his IT team were ready. Although the malware shut down production for about four hours and erased data on some laptops, it was blocked by a firewall that prevented the virus from exiting the plant’s network and installing the hacker’s “lock.”

In April, AW North Carolina was targeted again with different malware created by different criminals. The virus was contained before production was put on hold. Peterson said no ransom was paid in either instance.

According to NTT Security’s “Global Threat Intelligence Report 2017,” manufacturers — along with government and financial firms — are top targets for criminals, foreign espionage agents and other hackers. The report also unveils the following findings:

  • Cyberattacks increased 24 percent globally in 2017’s second quarter.
  • Sixty-seven percent of malware attacks were delivered by phishing emails.
  • The speed of attacks continues to increase exponentially once initiated.

The U.S. Department of Homeland Security adds that the number of cyberattacks affecting U.S. industrial control systems has doubled in the past two years. Experts there expect that these attacks will continue to increase as hackers develop custom ransomware to better target individual companies.

Emphasizing risk management

Are your company and your company’s supply chains prepared for the new age of cyber threats? It’s a matter of risk management, which is defined by the APICS Dictionary as, “The identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.”

As the AW North Carolina example illustrates, effective risk management requires coordinated business processes. The APICS Supply Chain Operations Reference (SCOR) model is the world’s leading supply chain framework and links business processes, performance metrics, practices and people skills into a unified structure. Throughout the structure, risk management is emphasized.

APICS is pleased to offer the SCOR-Professional (SCOR-P) endorsement, which establishes an in-depth knowledge of the SCOR model and methods. To learn more about how SCOR and SCOR-P might help you and your organization, visit apics.org/apics-for-business/products-and-services/apics-scc-frameworks/scor

This post originally appeared in APICS newsletter on August 18, 2017

Abe Eshkenazi currently serves as the chief executive officer for APICS and APICS Supply Chain Council. Prior to joining APICS, Eshkenazi was the managing director for the Operations Consulting Group of American Express Tax and Business Services.

How to truly excel as a manufacturing leader

By Micki Vandeloo, President, Lakeview Consulting

In my 25 years in manufacturing, I have not found too many leaders who didn’t want to excel. When leaders think about the potential for their company’s success, and helping their firm reach that potential, they get truly excited.

However, the excitement soon dims as they are pulled into meetings and start fighting fires. They lose sight of what energizes them, and start working IN the business rather than ON the business. This often leads to frustration, burnout, and anxiety. 

Does this sound familiar? If so, how do you, as a leader, get that excitement back?  I believe two key resources can dramatically impact your ability to excel in work and in life. 

Financial Resources

First, you must eliminate the frustration and anxiety. In my experience, most anxiety is caused by a leader’s inability to invest in growth. They see the potential for the company to increase market share and product offerings, but can’t justify the capital spending, facility expansion and training costs to facilitate that growth.

Grant funding and economic incentives can offset equipment, training and expansion costs, thereby increasing investment ROI and profitability. Find out more about how you can access grants and incentives in my upcoming webinar, Manufacturing Money.

Accountability Resources

Unfortunately, relieving the financial stress is only one step to help you excel. You must also relieve the stress of not progressing towards your goals. When you are constantly fighting fires, you are not achieving your professional goals. And, your frustration spills over into your personal life.

An Executive Coach provides the accountability, motivation and affirmation you need to develop a plan to excel, follow the plan and achieve your goals!  You will learn how executive coaching services can help manufacturing leaders realize these outcomes in my upcoming webinar as well.

Imagine leaving work and feeling like you accomplished something! Imagine experiencing greater life balance while excelling at work! This can be your reality! Take the first step today!

For nearly 8 years, Micki served in project management and leadership roles within the National Manufacturing Extension Partnership (MEP) system. Micki’s role in leadership in an MEP center launched her consulting career and a drive to see not only her clients, but the entire manufacturing industry, thrive. Today, she serves as a trusted grant writer and technical resource for manufacturing and technical program clients. Her expertise in identifying and attaining grants and other funding sources to support investment has helped countless clients accelerate growth and innovation. Connect with her on LinkedIn.

Increase growth & global competitiveness with sustainability

by Alex Leopardi, MEP Energy Consultant Intern

Sustainability can increase growth and global competitiveness, and it also requires economically robust processes designed to minimize environmental impacts, while conserving energy and natural resources.

Building sustainable business practices can help in the following ways:

Resource and production costs. 

Increasing resource use efficiency lowers the material and waste removal costs. For example, Houwelings’ Tomatoes, a large scale tomato growing company in Mona, UT, took advantage of incentives available through Rocky Mountain Power to implement high-efficiency products, saving $500,000 in energy costs and enough energy to power 1,056 Utah homes. They also designed their 28-acre greenhouse to be heated by waste heat from a nearby power plant. The hot carbon dioxide waste gasses are used to feed the plants and heat the facilities, rather than being released into the atmosphere.

Regulatory compliance costs. 

Sustainable operating practices improve compliance with current and future regulations.

Sales and brand reputation.

79% of American consumers want companies to provide more information about the environmental impact of product packaging so they can make informed shopping decisions.

Financing and capital.

Findings from a study showed that sustainable companies can more easily obtain financing by showing themselves to be more responsible, better managed, and less risky.

Employee hiring and retention.

In a survey by Forbes, 65% of American workers said they would seriously consider leaving a job if their company harmed the environment.

 

Alex is currently pursing a bachelor’s degree in chemical engineering at the University of Utah, and works jointly as an energy consultant intern with the MEP Center and IIAC. His areas of interests are energy efficiency, renewable energy technology, aerospace, and smart systems. You can connect with him on LinkedIn.

 

 

Why is OOT important in measurement traceability?

The concept of traceability of measuring equipment to an international standard to assure confidence of measurement results has been part of quality systems since the original Mil-Q-9858 in the 1950’s. Most organizations refer to this as “calibration”. The concept is to make sure all the equipment you use to measure your product related standards must be traceable to NIST to assure that all organizations measure using the same reference standards. Obviously it is important that when we measure an inch you get the same result as your customer.

Clause 7.1.5.2 in AS9100D describes the requirement:

There are many other requirements like a register, recall method and the organization shall determine the validity of previous measurements when the equipment is found unfit for its intended use. The last item is the focus of this tip.

It is very common to find equipment “As Found: OOT” when performing the comparison to a standard for measurement traceability (commonly referred to as calibration). “As Found: OOT” means that when the equipment was compared to a standard it was found out of tolerance (OOT). When this happens the AS9100D standard has a very specific requirement:

Here’s what the “As Found: OOT” looks like on a certification (this particular certificate is from Western States Calibration in Salt Lake City):

One of the most common findings in an AS9100D audit is not meeting the requirement to take action based on the “As Found” condition. Be sure that your system requires you to take action when equipment is found out of tolerance or when equipment is taken out of service. The action is usually to create an internal corrective action.

In the corrective action you must determine if the previous measurements are valid since the equipment was found out of tolerance.

When you take equipment out of service be sure to measure it against a standard using a valid process to determine the “As Found Condition”. If it is found OOT you must take the same action you take when the equipment is “As Found OOT” when being measured against a standard (commonly called calibration).