It starts with a right partner.
Church and Dwight is a Consumer Packaged Goods company and a
world leader in household and personal care products.
We're a place where people and diversity matter.
Church and Dwight has 14 power brands that consumers love, such
as Arm and Hammer™ baking soda, Therabreath mouthwash, Hero
Mighty Patch™ and WaterPik® flossers and toothbrushes.
I'm David Ortiz, the Chief Information Security Officer for
Church & Dwight.
I'm responsible for protecting our company and its people and
ensuring cybersecurity is embedded in everything we do,
starting with cybersecurity by design and helping our people
remain vigilant against cybersecurity threats.
We care about our customers, we care about our product quality,
and we care about our people.
Church & Dwight faced challenges with the need for
increased visibility into manufacturing cyber risks.
We worked hard to assess all of our manufacturing sites during
the pandemic and to understand vulnerabilities for our
manufacturing assets and potential threats against our
network.
The primary reason why OT environments are targeted these
days, and by the way they are the number one sector that's
being targeted today, especially by ransomware, is the fact that
security has been an afterthought in OT.
It's only since about 2017 when Wannacry and NotPetya hit, that
industrial companies have paid attention and started to invest
in OT cybersecurity.
Many of the assets that are out on the OT side of this
infrastructure, they could be 20 years old.
They were never designed to do anything but one thing.
So there was no security built into them.
The biggest challenge the Church & Dwight faced is the same
challenge that I hear from almost every customer.
I met with David Ortiz, the Chief Information Security
Officer, almost three years ago, and I got the same question that
I get from many, many customers and it was "Mark I need to start
an OT cybersecurity program and I have no idea where to start."
This is very, very common.
We had just an open dialogue and I gave him some pointers, some
best practices and we decided to continue the discussion.
So the solution components for Church and Dwight began with
what we call basic security assessments.
We went into all of their facilities with our specialized
OT cybersecurity team.
We helped them to identify the risks and more importantly, put
together remediation strategies to remediate those risks.
We chose Rockwell.
After viewing other potential partners, I thought that
Rockwell's knowledge of manufacturing and cybersecurity
and the fact that Church and Dwight is a Rockwell
manufacturing customer really gave them a leg up as well as
Rockwell's efficient production operations savvy approach.
So Rockwell Automation is best known as 120 year-old industrial
company that primarily is known for providing customers with
control system components that run machines and things like
that.
So we are very specialized in what we call operations
technology or OT.
About 12 years ago, we decided to go to market on a
cybersecurity services business that specifically differentiated
ourselves with that OT DNA that we bring to the table.
We know that the shop floor cannot go down.
We're in all industries So food and beverage very, very
important to us and big CPG like Church and Dwight is in.
Automotive, heavy industries such as metals and mining
process, oil and gas, heavy chemicals and things like that.
They are all applicable and well served by Rockwell Automation.
So, the assessment comprised looking at all of our global
manufacturing sites without over architecting the approach.
We wanted to preserve our manufacturing teams valuable
time commitment and to do that we from workshops did
assessments, did Q&A sessions keeping in mind
everybody's time commitment.
We did workshops with David Ortiz and his team to talk about
what the path forward should be in in terms of remediation.
And it really gave David, I guess, just an opportunity to
quantify the risk and get buy-in for what was going to be
required from an investment perspective for a more holistic
cybersecurity OT program.
We went through that very successfully with Church and
Dwight and now we are working with them on using our Secure
Operations Center as David's outsourced managed security
services provider for him and for the organization.
David did a great job socializing the need for a
holistic OT cybersecurity program.
He worked with each of the facilities, the plants that were
part of the program, to educate them because it's really
important that a site understands why people are
coming in to deploy countermeasures, to do
assessments and things like that because they need to be a part
of the process.
David did a fantastic job working down on that process.
He also did a great job selling up, I'll say, and that was with
the help of us.
We provided those assessments that were an objective third
party opinion with quantification of risks so that
he could provide an objective view of the enterprise risk
associated with not doing an OT cybersecurity program.
The assessments pointed to the need for a solution to be able
to discover any anomalous network traffic and
vulnerabilities and the ability to do threat detection.
We prioritize visibility into our manufacturing network as the
top priority, followed by incident response processes and
vulnerability detection.
In addition to this, Rockwell recommended threat detection, we
got stakeholder buy in by understanding our manufacturing
business, collaborating and building trust and support, and
explaining how cybersecurity investment can protect our
business from unplanned downtime.
Most important outcomes are alignment with our manufacturing
business, furthering our partnership with Rockwell and
being able to take swift action should something anomalous be
detected on our network.
I would say act now, partner with thought leaders, really
define the correct scope and align with the business on the
outcomes and introduce technology only after
understanding the business needs.
This really all starts with the partnership and David was very,
very amenable to get into a partnership with us knowing that
it would be a very long term relationship and so far it's
been very, very productive.