Digital Trust in Manufacturing – here comes the Chief Product Security Officer

Business leaders often view cybersecurity as a specialized IT role when in reality, it is a subset of enterprise and business risk management. The purpose of cybersecurity is no longer to secure things; rather, it is to help businesses succeed in hostile environments.

One way to achieve this resiliency is to integrate cybersecurity responsibility and accountability into business technology and risk management roles at different levels of the business and the creation of a Chief Product Security Officer (CPSO) function.

Significant macro changes around product digitization signal the need for a CPSO. Customers expect more in terms of connectivity and information sharing and are disappointed with undisclosed information leaks that impact their privacy.

Businesses are also responding to elevate their security capabilities from a product offering perspective. Business financials are impacted by this shift, as investments are made to digitize and secure the supply chain and find new revenue sources (e.g., data monetization). As a result, today's executives and boards are more aware of cyber risks. Some have started recruiting former cybersecurity leaders to chair risk committees and oversee cyber risk management.

This level of awareness from every direction (customer to the Board) disrupts traditional production processes, including the supply chain. Creating resilient product supply chains is an investment, and it requires modernizing data management practices, integrating information systems, and building collaborative relationships across the chain.

Comparatively, we can distill these macro trends into five specific themes driving product security.

• Regulations and mandates: The drafting of guidelines and preparation for impending mandates and regulations have seen significant movement and progress. As mandates are finalized and implemented, the investment required to comply, the potential reputational damage, and the cost of a data breach will only increase. Non-compliance will be penalized as the regulatory environment tightens.
• The need to differentiate in a crowded marketplace: Industry structure, boundaries, competition, customer needs, and business strategy are profoundly affected by smart connected products. These changes directly have a financial impact on supply chain security, sales, and customer relationships.
• A different kind of supply chain: The focus is no longer on product security but on building trust in every aspect of the supply chain that leads to a customer-facing product. Increased reliance on connected components (e.g., open source software, APIs, compliance as code, Software Bills of Materials (SBOM), vendor dependency, hardware connectivity) elevates product supply chain risks.
• Sharing and monetizing data to create value: Organizations realize the need to capture, protect, analyze, and, more importantly, monetize data to maximize revenue. These information exchanges exist within the organization and are now extending to suppliers, manufacturers, and customers.
• Increasing focus on customer experience: It is becoming increasingly critical for product manufacturers to ensure that their products are secured when deployed "in the field," such as on potentially hostile customer networks. The question of how much functionality should be embedded in a product versus in the cloud is always an ongoing conversation and has implications for consumer privacy. The competitive landscape has also shifted, with robust product security capabilities becoming not only a differentiating factor in the market but a minimum requirement.

These driving forces are creating a world where more devices and systems are connected, and customers demand products to be secure. It is becoming increasingly important to have someone responsible for product security. Despite overlaps in the focus of enterprise security and product supply chain security, there are distinct operational differences. These differences are even more relevant when viewed from a threat actor's perspective.

Product security is a business necessity of digitization

In recent years, the drive to Digital has been instrumental in signaling business pain points where technology can help solve problems and spearhead ideas. However, the existing organizational culture is often at odds with digital culture (collaboration, innovation, data-driven insights, and customer-centricity).

Product security is no longer a 'nice-to-have.' In today's business environment, product security is imperative. It is not a passing trend and will continue to gain traction within the business cycle. Traditional products (such as medical devices, cars, and trucks), previously considered "dumb," are now being designed and developed with connectivity in mind. This shift requires executives to consider connected products' business impact.

In summary, the CPSO role is new and evolving, and it is not yet clear what the specific responsibilities are and how it fits into the overall organization. As the importance of product security increases, the CPSO role will likely become more defined and essential. Regardless, it is becoming increasingly important to have someone focus specifically on product security as software and devices become more connected, and customers' expectations increase.