Download - 2018 Smart Pharma - Pharmaceutical Industry
TABLE OF CONTENTSDealing With Digital Demons 3
To advance, pharma must confront its digital transformation fears head-on
Turning a Buzzword Into Exponential Impact 9
How data is changing pharma operations
Boosting Cybersecurity in Pharma 16
Appropriate defensive measures are key to protection, starting with
a security risk assessment
eBOOK: 2018 Smart Pharma 2
www.PharmaManufacturing.com
Every industry has its demons. The
pharmaceutical industry’s strug-
gles — its aversion to risk, fear of
regulatory backlash, the siloed nature
of its organizational structure — are
well documented.
But today’s developing environment —
coined the Fourth Industrial Revolution
and characterized by rapidly evolving and
disruptive advances in technology — has
created a new and intimidating landscape.
According to the World Economic Forum,
this current revolution is “reshaping indus-
tries, blurring geographical boundaries,
challenging existing regulatory frameworks,
and even redefining what it means to be
human.”1 In this new world, tools such as
automation, IIoT, cloud-computing and data
analytics offer all industries the potential for
digital transformation — if they can properly
understand and implement them.
Pharmaceutical Manufacturing’s second
annual Smart Pharma survey separately
asked drug manufacturers and equipment
and services vendors their thoughts on
the pharma industry’s digital transforma-
tion progress.
Close analysis of the survey results confirms
a lot of what we already know: The pharma-
ceutical industry has seen great advances in
transformative technology, and it’s becom-
ing increasingly evident that if properly
harnessed, many of these innovations can
give manufacturers an edge. But recent
survey results closely mirror the responses
from last year — and the concern is that this
could mean progress is stalling.
Dealing With Digital DemonsTo advance, pharma must confront its digital transformation fears head-on
By Karen Langhauser, Chief Content Director
eBOOK: 2018 Smart Pharma 3
www.PharmaManufacturing.com
In order to keep moving forward and propel
itself into the next stage of digital trans-
formation, pharma needs to confront some
very real challenges.
THEY BELIEVEThe good news is that pharma believes
in digital. Over 70 percent of surveyed
pharma manufacturers see the big pic-
ture, understanding that in the long-run,
a more automated pharma industry will
improve productivity, quality, and efficiency
— and cut costs. This year, the number of
manufacturers who specifically indicated
a connection between automation and
cost-cutting jumped from 55 to 71 percent
— perhaps a positive sign that manufac-
turers are starting to see actual financial
benefits from successful digital initiatives.
Cultural buy-in, especially from a traditionally
conservative industry, is also crucial for suc-
cess. According to survey results, the industry
is noting a rising comfort level with the new
computing, control and communications
technologies represented by the IIoT. Over
79 percent of pharma respondents noted an
increase in automation-related comfort in
the industry, while 83 percent of vendors (up
15 percent from last year) agreed that the
pharma workforce’s comfort level is rising.
Encouragingly, when it comes to designing
or upgrading manufacturing facilities, 87
percent of manufacturers and 91 percent
of vendors said that digitalization is part of
the discussion. Of this group, 36 percent of
manufacturers said digitalization is actually
the leading priority.
AT STARTING GATE IDENTIFYING PILOT APPLICATIONS INVESTING IN APPLICATIONS
Ven
do
r R
esp
on
se
Phar
ma
Res
po
nse
All
Mfg
ing
/Pro
cess
ing
33.5%
46%
55%
Ven
do
r R
esp
on
se
Phar
ma
Res
po
nse
All
Mfg
ing
/Pro
cess
ing 30.5%
41%
34%
Ven
do
r R
esp
on
se
Phar
ma
Res
po
nse
All
Mfg
ing
/Pro
cess
ing
36%
13%11%
Exhibit 1
Digital Transformation/IIoT Initiatives Progress
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 4
TECHNOLOGY IS LURKINGDigital technology is everywhere — firmly
embedded in our personal and professional
lives — to the point where it is difficult to
claim that a lack of technological innovation
is holding back progress.
Survey answers support the assertion that
the technological innovation needed for
pharma to succeed on its digital trans-
formation journey is available, and at
increasingly affordable costs, too.
When ranking their concerns surrounding
smart manufacturing plants, tech innovation
— specifically the concern that “technol-
ogy being offered to the pharma industry
is not advanced enough” — was second to
last on the list of manufacturers’ concerns
and dead-last according to vendors. But
perhaps vendors are warranted in giving
themselves a pat on the back, as it seems
that overall, the industry is confident that
the level of technology being offered is
advanced enough to do the job.
These results are in consonance with the
manufacturing sector in general, as well. At
the recent Smart Industry 2018 Conference
— an annual event geared toward accel-
erating the ongoing digital transformation
of manufacturing — the exhibit hall was
overflowing with innovative technologies.
Yet during three days of presentations, the
focus was not on technology, but instead,
how to integrate and use these new tools to
maximize benefits.
In pharma, there appears to be a debate
as to who is responsible for continuing to
advance this technology. According to
survey results, pharma manufacturers are
somewhat split between believing vendors
should be proactively leading the charge,
believing vendors should be reacting to the
needs of pharma companies, or believing
there should be collaboration between both
parties. Vendors, however, are more deci-
sive: Over 50 percent believe they should
be leading the innovation charge, while a
mere 12 percent feel they should be react-
ing to the demands of drug manufacturers.
REALITY CHECKLast year’s survey revealed that overall,
pharmaceutical manufacturers were more
1. INTEGRATION
Difficulty integrating new tech-
nology with existing lines
or equipment
2. REGULATORY HURDLES
Lack of regulatory buy-in or
understanding of new processes
3. EDUCATION
Training and keeping employees
up-to-date with new equipment/
processes
Top concerns for pharma manufacturers about
smart equipment
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 5
optimistic than vendors about the industry’s
digital transformation progress. This year’s
results saw that gap shrinking — perhaps
a natural balancing out as the industry, as
a whole, gains a clearer picture of where
they stand.
When asked to describe the pharma
industry’s collective progress on digital
transformation initiatives, the vast majority
(87 percent of manufacturers and 89 per-
cent of vendors) put the industry into one
of two categories: at the starting gate, with
focus on learning and exploration, or identi-
fying early applications to pilot.
Pharma shares this reality with other indus-
tries as well. A recent collaboration between
the World Economic Forum and McKinsey
& Co.1 found that more than 70 percent
of industrial companies are still either at
the start of their journeys or unable to go
beyond the pilot stage. The latter stage is
referred to as “pilot purgatory” — where
technology is rolled out experimentally at
reduced scale for an extended period due
to the inability or unwillingness to deploy at
a larger scale.
For pharma, when it comes to reaching
the more advanced stage — identifying
RES
EAR
CH
AN
D D
EVEL
OPM
ENT
PLA
NT
FLO
OR
PR
OD
UC
TIO
N
SUPP
LY C
HA
IN M
AN
AG
EMEN
T
QU
ALI
TY
CO
NTR
OL
EQU
IPM
ENT
MA
INTE
NA
NC
E
PAC
KA
GIN
G
OTH
ER
12%
5%
41.5%
35%15%
17%
24%
21%
7%
3%
7%
10%
3%2%
Pharma Manufacturers Vendors
What area of pharma manufacturing do you feel would see the most benefit from increased digitalization?
Exhibit 2
2%3%
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 6
applications and making investments to
match — it seems few manufacturers are
willing to make the financial leap. Even at
a basic level, when vendors were asked if
pharma companies were looking to replace
outdated equipment with improved robot-
ics or controls automation, only 6 percent
could decisively claim that most companies
are actively updating.
WHY PHARMA LOSES SLEEPWhat is keeping pharma up at night when
it comes to digitalization? When asked to
rank their companies’ concerns (or for ven-
dors, their customers’ concerns) regarding
smart equipment in plants, this year, both
manufacturers and vendors prioritized inte-
gration — specifically the potential difficulty
that comes with integrating new technology
with existing lines or equipment.
In pharma, managers of legacy facilities
are no strangers to addressing the prob-
lems associated with aging infrastructure,
equipment and processes. The need to
accommodate new, digital technology adds
an additional layer of complexity. Fortu-
nately, vendors are rising to the occasion,
providing ways to upgrade technology
without replacing existing machines.
Devices such as serial servers and media
converters can give existing equipment
new connectivity options and the ability
to communicate.
Regulatory hurdles slipped from the No. 1
concern to the second spot this year, for
both manufacturers and vendors. With
compliance being essential in pharma, it
makes sense that lack of regulatory buy-in
or understanding of new processes would
continue to be a challenge. When vendors
were asked directly what they thought was
the top issue holding back their customers’
digital progress, fear of regulatory back-
lash (30 percent) and an unwillingness to
pioneer unproven technology (27 percent)
topped the list.
But as the industry progresses down its
digital path, it’s important to involve reg-
ulators early and often. According to the
BioPhorum Operations Group, (a cross-in-
dustry collaboration), pharma’s transition
will require “diligence by industry to show
regulators the benefits of the move, but still
According to survey results, larger, U.S-based
biopharma manufacturers are the most highly
automated and digitally advanced in the industry
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 7
show the ability to maintain data integrity,
demonstrate control and custody of oper-
ating software in an open environment, and
validate the use of real-time release instru-
ments and process models.”2
TIME TO LOOK UNDER THE BEDFor a second survey year in row, pharma is
finding itself at a familiar digital transforma-
tion crossroads: The industry understands
the power of digital, has made a few pilot
investments, but can’t continue its journey
without fully investing.
And pharma isn’t alone. During this year’s
Smart Industry Conference, Brian Irwin,
automotive and industrial lead for IT consul-
tancy giant, Accenture, pointed to research
across multiple industries indicating that
while 80 percent of industry executives
expect both efficiency and growth from
digital, only 13 percent are investing cor-
respondingly. Across all industries, Irwin
confirms, very few companies have made
it to the phase of digitalization where they
have found a way to see growth and profits
from their digitalized business model.
Exactly how far away is pharma from truly
reaping all the benefits of IIoT and the smart
factory? According to our survey results,
64 percent of pharma manufacturers and
86 percent of vendors believe the industry
is five to 10 years away. Yet, 27 percent of
manufacturers still feel the industry is more
than a decade away from reaching this goal,
or will never actually get there — demon-
strating that equivocation is still very real.
But this hesitation, according to McKinsey
& Co., may not be the best course of action.
McKinsey analysts (see the article on the
next page) describe small-scale digital
initiatives and pilot investments as “self-lim-
iting,” warning that they “will not generate
the kind of dramatic results that leaders
expect, potentially threatening future
investments.” Instead, experts insist that
in order to take full advantage of digital,
companies need to think in comprehensive
terms, by making more dramatic, sys-
temic changes.
“Launching a ‘digital transformation’ can
seem ambitious. But tentative half-mea-
sures will not capture the full potential from
technology,” says McKinsey.
Those looking to keep up with frontrunners
will need to put fears aside and confront
their digital demons head-on, pushing
themselves itself into the most rewarding
stage of digital transformation.
REFERENCES1. The Next Economic Growth Engine
Scaling Fourth Industrial Revolution
Technologies in Production. World Eco-
nomic Forum, January 2018.
2. The Technology Roadmap for the Bio-
pharmaceutical Manufacturing Industry.
BioPhorum Operations Group, July 2017.
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 8
Aircraft today can be fully devel-
oped in a digital environment.
They are designed using CAD soft-
ware and tested in a virtual flight simulator,
before any physical work happens. Imagine
the same in pharma: A COO can model var-
ious product portfolios, swap out machines,
or model utilization and schedules to
optimize agility and cost — all using soft-
ware and delivering quantifiable answers
in seconds.
Science fiction? Yes and no. The technol-
ogy exists today — including predictive
analytics, robotic process automation,
and AI-based tools, all digitally connected
via the Internet of Things (IoT) — but no
pharma company has fully leveraged it.
Some companies apply point solutions and
individual tools, but most get stuck in the
pilot phase and struggle to scale up digital
across the enterprise. This approach leads
to limited results that might excite the CIO
but not the CEO.
Why is it so difficult to implement these
tools at scale? You need visionaries — and
not just pragmatists — to see the full
potential of digital. At the same time, orga-
nizations need to manage expectations
and understand the impact will come in
successive horizons, not all at once in the
next budget cycle. Finally, companies need
to think of digital not as a series of individ-
ual tools but as a means of transformation,
requiring technology and people.
THE LESSONS OF LEAN MANUFACTURINGThe lean methodology was invented by
Turning A Buzzword Into Exponential ImpactHow data is changing pharma operations
By Daniele Iacovelli, Thibaut Dedeurwaerder, Parag Patel, Eoin Leydon, McKinsey & Company
eBOOK: 2018 Smart Pharma 9
www.PharmaManufacturing.com
Toyota as part of the company’s famed
Toyota Production System. Throughout
the 1980s and 1990s, that system led to
massive success in the automobile indus-
try, with extremely high quality standards
and lower costs, allowing Toyota to dra-
matically increase its global market share.
In response, other car manufacturers —
most notably U.S. companies like Ford
and GM — tried to copy the principles of
lean. Yet, their early efforts were high-pro-
file disasters, in part because they tried
to implement individual lean tools and
processes without having the right organi-
zational elements in place.
This approach was bound to fail. In fact,
the actions of those companies were
almost more disruptive than taking no
action at all. One book, “The Machine that
Changed the World,” recounts this strug-
gle: “Lean-production methods on existing
mass-production systems causes great pain
and dislocation.” It took years for these
manufacturers to realize that success in
lean required more than merely plugging in
some new technical tools or using fancy ter-
minology. Rather, it required a fundamental
rewiring of the organization and manage-
rial system, which led to a cascading set of
implications from the executive suite to the
shop floor.
As with lean, the value from digital and AI
will not come from trying to bolt tools onto
existing processes. It will come through
a comprehensive transformation of the
entire organization. Currently, many pharma
companies are at the earliest stages of
experimentation, still limited to pilot tests,
small-scale digital initiatives, and proof-
of-concept exercises (or, as a recently
McKinsey & Company paper published
in conjunction with the World Economic
Forum termed it, “pilot purgatory”). These
are self-limiting; They will not generate the
kind of dramatic results that leaders expect,
potentially threatening future investments.
If these companies are to take advantage of
digital, they need to think in more compre-
hensive terms, by making systemic changes.
WHY THE FUTURE IS DIFFERENTThis kind of comprehensive approach is
necessary because of five fundamental
shifts in the way pharmaceuticals will be
produced in the future. Collectively, the
shifts are leading to a quantum change in
manufacturing and order-of-magnitude
improvements in processes.
1. Advanced product and process mastery.
First, companies can use new technologies
to better understand how input param-
eters such as machine settings, operator
training levels, or raw material options will
affect quality and outcomes. In practical
terms, companies can build an advanced
analytical model and run historical data
on chemistry, manufacturing, and controls
(CMC) through the model to determine the
impact of individual changes. By mapping
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 10
outputs to inputs, companies can proac-
tively optimize all inputs and thus reduce
variations. In addition, by documenting this
level of control over input parameters to
regulators, companies can get rid of testing
and thus cut throughput times in half. This
obviously also boosts efficiencies, as most
of the quality assurance and quality control
tasks disappear.
2. Real-time predictive analytics.
Production managers start their day with
a simple question: What is my biggest risk
right now? Analytical models to predict
critical events can answer this question.
The risks can be deviations, quality issues,
machine failures, or large changes in
demand. Pharma operations executives can
leverage big data, external and internal indi-
cators, and machine learning algorithms to
better forecast demand, and automatically
identify and mitigate supply risks.
3. E2E digital twin simulation
and optimization.
Companies can also build digital simulations
of production processes — on the level
of individual machines, labs, factories, or
entire manufacturing networks (just like the
aircraft example). These real-time digital
twin simulations allow companies to steer
processes proactively by predicting the
effect of adding a new machine, changing
schedules, or changing the team alloca-
tion — all before applying those steps to
physical assets. In this way, the company
can optimize production parameters for
highly complex systems, accurately and
proactively, without risk. This is a signifi-
cant advance in efficiency compared to the
traditional approach of sifting through his-
torical data manually.
How is this different from existing planning
and scheduling solutions? Real-time digital
simulations offer dramatic improvements
in speed and accuracy. “Demonstrated per-
formance” for factors such as lead times
or machine output replaces master data
(which still today is of poor quality in most
companies). Manufacturers can use real-
time AI-based insights to evolve beyond
simplistic rules like “frozen periods,” rhythm
wheels, or minimum order quantities. Com-
panies can run multiple simulations at the
same time, allowing them to plan across
multiple dimensions simultaneously, moving
to multi-echelon planning. All this saves
time and reduces the need for inventory
buffers, so that companies can plan and
sequence runs more effectively while stay-
ing focused on customer requirements.
4. Automation of knowledge work
and robotics.
Finally, tools are emerging to automate and
improve knowledge work and administra-
tive processes. For example, digital robots
can autonomously handle measures such
as supply planning and scheduling, or use
self-learning algorithms to support deci-
sions such as portfolio margin optimization
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 11
or corrective and preventive actions
(CAPA). In the case of a product devia-
tion, natural language processing can show
where and what went wrong and compile
this into a Pareto diagram or some other
type of visualization. All these solutions
reduce time — mainly of white-collar work-
ers — and not by 10 percent, but by 90 to
100 percent.
5. Digital operations assistance.
The biggest weakness in pharma produc-
tion is human error. Statistically, tasks
performed by humans are about 92 per-
cent accurate. This is incompatible with
the compliance expectation in pharma.
Therefore, the shop floor is increasingly
digital, powered by new systems that
support operators in daily tasks — partic-
ularly those that are highly repetitive. For
example, tools such as augmented-reality
glasses could show operators the checklist
of steps needed to finish specific pro-
cesses, or confirm that required measures
have been completed, along with gather-
ing and reporting data to fuel analytical
models. Managers could also be given a
tablet-based dashboard with real-time per-
formance KPIs, losses, machine status, and
potential measures to improve. If something
goes wrong — or is likely to go wrong — the
managers receive an alert.
THE BUSINESS CASEPharma supply chains have traditionally
been characterized by long lead times (up
to one year for the median pharma com-
pany)1 and high inventories (250 days).2
And although customer service levels are
relatively high, most companies still spend a
lot of time firefighting and balancing supply
and demand issues.
So, what is the business case for digital?
The technology is in the early stages, mean-
ing any estimate is just that — an estimate.
Yet, McKinsey research suggests that com-
panies aggressively digitizing their supply
chains can expect to boost annual EBIT
growth by 3.2 percent and revenue growth
by 2.3 percentage points.3 This impact
comes from increasing both the efficiency
and the effectiveness of supply chain plan-
ning and decision making. By connecting
the supply chain end to end through real-
time performance feedback and leveraging
data from various sources (including ERP,
MES, and external data), supply chain exec-
utives can generate greater visibility and
improve performance.
Ultimately, digitizing the supply chain cre-
ates a strategic competitive advantage that
boosts the supply chain organization from
an execution-focused function to the center
of business growth.
THREE HORIZONS TO GENERATE SCALECompanies seeking to capitalize on these
shifts typically start by launching small, tar-
geted measures and then scale up across
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 12
the organization. We see this process
playing out in three horizons, with increas-
ing gains in productivity and agility as the
scope of projects grows.
In the initial phase — the experiencing hori-
zon — the transformation is about launching
use cases that are high impact but limited
in scope, typically aimed at one specific
unit or process. The objective is to build
up experience and generate momentum.
Even at this early stage, companies begin
to see increases in operational efficiency,
reliability, and agility. For example, based
on recent digital plant transformation cases,
we have seen:
• Reductions in deviations of up to 80%
• Increases in lab productivity by up to 60%
• Reductions in closures due to deviations
of up to 80%
• Increases in OEE of more than 40% on
packaging lines
• Reductions in changeover times by more
than 30%
Once the company has gained some basic
experience, it is time to shift to an exploring
horizon. In this phase, companies launch
“lighthouse” projects that demonstrate the
full potential of a given technology and
serve as an inspiration and innovation hub
for the company as a whole. The scope
covers the entire site, and the company
starts using technology to differentiate
itself against the competition. Typical
achievements in the exploring horizon
include prescriptive analytics (rather than
descriptive), fully standardizing data across
an entire production site, or a suite of
advanced digital assistance to all operators
at the site. It is critical in this phase to use
models geared to value creation. Compa-
nies can expect an additional 50 percent
increase in terms of efficiency, quality, and
flexibility metrics.
Finally, companies can advance to an envi-
sioning horizon, in which digital is rolled
out across the entire value chain. By now,
the organization has predictive machine
learning models in place that can actively
suggest optimization measures. Data is
easily accessible and transparent, including
secure e-validation from end to end. Many
tasks have disappeared (such as testing)
and regulatory and technology changes
are simulated and approved. Advanced
digital assistance tools are in place through-
out all production sites (including those
of suppliers and customers). At an envi-
sioning horizon, companies can register
a 100 percent increase across key opera-
tional metrics.
KEY SUCCESS FACTORSThe reason many companies fall short in
digital transformation is that they focus too
much on the tools and applications, and
not enough on building the right internal
foundation. A truly transformative system
change can only happen if companies have
the conditions in place. To that end, there
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 13
are several key success factors that man-
agement teams should focus on.
Invest in capabilities and adjust
the organization
According to some estimates, up to 60 per-
cent of manufacturing tasks can ultimately
be automated by digital. However, that
does not mean that 60 percent of jobs will
go away. Rather, digitization will transform
the way work gets done, scaling back the
need for some positions but creating new
demand for others. For example, data sci-
entists, data engineers, and developers that
specialize in user interfaces will be in high
demand. Already, companies are fiercely
competing for people with these skills,
by launching dedicated internal capabili-
ty-building programs, collaborating with
universities, and revamping degree and cer-
tification programs. Moreover, companies
are redrawing organizational lines to deploy
digital production — for example, creating
cross-functional teams that combine opera-
tions disciplines with IT. Others are realizing
that the elimination of tasks in planning,
analyzing, training, and supervision has
implications on workloads as well as the
required skills of their people, and they are
rewriting job descriptions accordingly.
Apply strong change management
Launching a “digital transformation” can
seem ambitious. But tentative half-mea-
sures will not capture the full potential
from technology. Companies need to apply
strong and deliberate change management
through a comprehensive program that
spans the entire value chain. Moreover,
the transformation will disproportionately
impact the middle layers and white collar
workers in expert roles. Unless you have
a vision and provide support to these col-
leagues — starting with a story that clearly
communicates the need for change — the
adoption of digital will stall.
Consider the perspective of a planner or
process engineer at your company. After
the first successful pilot of automated
planning or AI used to predict batch out-
comes, people in these roles will see that
the processes they have spent years study-
ing and improving can be executed by an
algorithm in seconds, often with greater
accuracy. It is inevitable that the sheer
speed of information flow and transparency
of performance data will create discomfort
for many employees throughout the orga-
nization. Change management — starting
with a change story, a strategic resource
plan, and a reskilling program to build new
cross-functional teams — can address this
discomfort and ensure the overall program
stays on track.
Rethink your approach to IT infrastruc-
ture development
Rather than thinking about IT projects as
multi-million dollar, year-long transitions
without a clear business case, companies
should set up a common platform to
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 14
connect all data sources (for example,
through a data lake). The trick to connect
more data in less time? Start with business
needs. Once you have created the data
lake as a foundation, you only create the
two to five percent of connections that
actually matter for the first generation of
use cases. Transformations typically require
20 to 25 use cases before they generate
sufficient momentum. Achieving this level
of connection can take three to six months
using a data lake — not three to four years
as with traditional IT projects. This approach
— also called “agile development” of IT
infrastructure — is obviously a mindset shift
and in some cases may not mesh with the
existing IT roadmap that many companies
already have in place. Unless there is clear
agreement among the leadership team, this
misalignment can quickly lead to delays.
Break the budget cycle mindset
Over the past decade, pharma operations
have focused on reducing waste through
measures like lean and sigma. Those efforts
led to remarkable successes and sizable year-
over-year cost savings — especially given the
low cost of those measures. The downside
is that some companies now have a short-
term mindset. Digital holds tremendous
potential, but it may not deliver gains on a
predictable schedule that can be built into the
budget cycle. Victories will require targeted
investments in areas like IT, automation, and
other technical solutions. Leaders need to
help their teams distinguish between “budget
tightening” initiatives and the investments
needed to get to a digitally enabled future
state. For this reason, some companies have
created separate budgets managed by a
leader with oversight over digital programs.
Digital manufacturing in pharma is not just a
far-flung vision; increasingly, it is the indus-
try’s new reality. Leading companies are
developing a vision and roadmap for imple-
mentation, putting them on track to capture
substantial value via gains in production
capacity and reductions in unit costs. What
is more, they are transforming their orga-
nizations to fully embrace innovation and
position them to compete in a future that
will look very different.
FOOTNOTES1. 228 days API, 75 days formulation, and
41 days packaging. Source: McKinsey
POBOS Supply Chain.
2. Including raw materials, intermediates,
drug substances, excipients, bulk pack-
aging materials, and finished goods at
plant, in-transit, and country distribution
centers.
3. J. Bughin, L. LaBerge, and A. Mellbye,
“The Case for Digital Reinvention,” McK-
insey Quarterly, February 2017.
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 15
In 2010, the industrial world changed,
probably forever. The first cyber weapon,
called Stuxnet, fashioned specifically to
compromise industrial automation equip-
ment was turned loose on the world of
manufacturing. Stuxnet crossed the bound-
aries of IT infrastructure and moved into
industrial automation. It, and soon-after
other worms, compromised programmable
logic controllers (PLCs), collected infor-
mation on industrial systems and changed
programming to deliberately damage the
connected equipment. This was an alarm
bell, but few managers had any idea of how
to respond.
Today, process manufacturing in gen-
eral and the pharmaceutical industry in
particular are seeing increasing num-
bers of cybersecurity threats. To protect
themselves, companies have to change the
way they operate by addressing cyberse-
curity threats and designing appropriate
defenses. Pharmaceutical companies have
to recognize their high visibility and attrac-
tiveness as targets. They must work to
understand cybersecurity concepts, identify
weak points and implement appropriate
security measures.
Process automation systems used to be
considered safe. They were proprietary and
isolated from external networks, effectively
cutting off any attack vectors. This isola-
tion didn’t last as companies established
connections to IT networks to provide
remote access by management. Often this
provided a path all the way to the inter-
net. Security-by-obscurity and air-gapped
defenses quickly faded away due to a lack
Boosting Cybersecurity in PharmaAppropriate defensive measures are key to protection, starting with a security risk assessment
By CheeHoe Lee, Yokogawa Electric Corporation
eBOOK: 2018 Smart Pharma 16
www.PharmaManufacturing.com
of effectiveness. The wide-scale introduc-
tion of the industrial internet of things (IIoT)
is and its fully connected factory concepts
is tearing down any remaining isola-
tion protections.
NO SINGLE CURE-ALL SOLUTIONA bank’s customers expect their money to
be protected. Not only does it lock its vault
and office doors to protect physical assets,
it also has to protect customer data and
financial information. These require different
methods of protection, so a multifaceted
defensive strategy is necessary. Similarly, a
connected pharmaceutical operation must
use appropriate methods to protect its
physical and digital assets.
Different types of assets require different
methods of protection and there should
be multiple layers of protection. That’s the
logic behind defense-in-depth security.
It assumes any single layer of protection
can and likely will be defeated, and thus
uses multiple layers of protection. How
these are conceived and implemented has
to be driven with appropriate authority to
be effective.
A TOP-DOWN APPROACHAll companies make some type of secu-
rity efforts from locking the office door to
having a password on a computer. Compa-
nies large enough to have basic IT services
will implement various cyber protections,
inadequate though they may be. Such is
not always the case for manufacturing
systems, also called operational technol-
ogy (OT). This is considered a different
world and consequently treated differently.
StrategicPolicy
Commitment Leadership
Organizational Responsibility
Audit Responsibility
Procedures
Policy
Monitoring Controling Optimizing Reporting
TacticalProcedures
Site 1 Site 2
Operational Work
InstructionsSystem A System B System C System D System E
Help Desk Infrastructure
Figure 1: A cybersecurity program must span the entire organization, with strategic leadership and policy provided by upper management.
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 17
Security-by-obscurity concepts are often
still used whether they are valid or not. Not
all senior managers understand this second
world or how to protect it, often resulting in
insufficient resources and budgets.
To secure the necessary support, a top-
down approach is necessary, driven by
senior-level managers using risk-based
methodology. The strong upper manage-
ment support must be supplemented by
dedicated champions and defined funding
under a clear implementation process. The
top layers of the organization deal with
strategy, risk and governance while lower
levels deal with operational tasks (Figure 1).
Bottom-up approaches alone rarely suc-
ceed in the long term. They may help
address point issues or specific weaknesses,
but they can’t reach far enough to take the
bigger picture and root causes into account.
The preferred methodology is to align a
top-down approach with its emphasis on
planning with a bottom-up approach to the
daily work that must be done to implement
a sustainable cybersecurity program.
CONDUCTING A RISK ASSESSMENTA cybersecurity program extends far
beyond installing firewalls and anti-virus
software. Cybersecurity programs for the
IT or OT domains should be embedded
into the company’s business processes at
multiple levels. One proven cyber secu-
rity program methodology embraces the
FARM approach:
• Frame—Defines scope
• Assess—Measures risks
• Respond—Outlines responses to
threats, and
• Monitor—Ensure continued effectiveness.
The assessment step determines the current
security and maturity level of the plant and
OT networks. It derives baselines for the
protections implemented in the response
step, and maps any gaps against the
industry’s and the individual company’s pro-
tection level.
ASSESSMENT TOOLSProtection level analysis provides a useful
assessment yardstick. It is a two-sided
technical measure to quantify the state of
Protection Level
4 D+ C+ B+ A+ PL D Protection against casual or coincidental violation
3 D C B A PL CProtection against intentional violation using simple means with low resources, generic skills and low motivation
2 D- C- B- A- PL BProtection against intentional violation using sophisticated means with moderate resources, IACS specific skills and moderate motivation
1 D- C- B- A- PL AProtection against intentional violation using sophisticated means with extended resources, IACS specific skills and high motivation
1 2 3 4
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 18
individual elements of a cybersecurity pro-
gram. The protection level is derived from
a combination of the security level, which
can be provided by technical measures, and
the existing maturity level of organizational
measures. Let’s unpack this concept.
The security level (SL) is based on
the requirements and represents the
achieved protections available with the
automation solution’s technical capabilities
as determined by the assessment. The
maturity level (ML) is inferred by the
procedural capabilities of the plant
or facility personnel. It is potentially
associated with technical capabilities, such
as administration of password policies
enforced by automated login and account
management software.
Consider an example: A small produc-
tion unit is built around a bioreactor and
its ancillary equipment. The process is
controlled by a PLC programmed with
the recipes and procedures to make the
range of products produced in this biore-
actor. When assessing this unit, it will be
necessary to see how well protected the
PLC is from threats coming through the
plant network or other possible attack vec-
tors. A low security level suggests it is very
easy to extract information or reprogram
the PLC. A high security level says it cannot
be accessed without appropriate authoriza-
tion, authentication, etc.
Maturity reflects more on how individuals
understand company policies and interact
with the control components and equip-
ment. A low maturity score suggests sloppy
practices such as writing the password for
the PLC on the cabinet, or no password at
all. A high maturity score indicates workers
are methodical about following established
procedures, and understand the impor-
tance of what they are doing and how
their actions can support or hinder secu-
rity efforts.
During the assessment process, security
level and maturity level values are used as
the axes of a four-by-four matrix, and a pro-
tection level value is assigned to each cell
in the matrix. The protection level relates
Based on this assessment, a security
framework can be established along
with policies and procedures.
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 19
the achieved security level of the technical
measures with the related organizational
measures (Figure 2). Therefore, achieving a
high protection level requires a high protec-
tion and maturity level.
ASSESSMENT RESULTSAt the end of the cybersecurity risk assess-
ment, the team produces a comprehensive
risk assessment report, a threat catalog and
a risk treatment plan. Based on the findings
of this assessment, a security framework
can be established along with policies and
procedures. Policies are guiding principles
for a variety of functions:
• Set direction in an organization
• Outline security roles and responsibilities
• Define the scope of information to be
protected, and
• Provide a high-level description of the
controls that must be in place to protect
the OT domain
Policies make references to standards and
guidelines. From a legal and compliance
perspective, a policy is considered as a
commitment from senior management
to implement the program throughout
the organization.
Standards help ensure security consis-
tency across the business and the use
of best practices. However, companies
should be vigilant to ensure they do not
become merely guidelines to be applied
when convenient.
Procedures describe how each policy will
be put into action in the organization, and
describe how something is accomplished.
Procedures describe who, what, where,
when and why by means of establishing
corporate accountability in support of a
policy. The description is related to the
work processes and not to specific techni-
cal solutions. The output of a procedure is
an input to a work instruction describing
how to perform a certain task, which is a
more detailed portion of the procedure, and
often solution- and role-specific.
PROTECTING INDUSTRIAL CONTROLS WITH THE RIGHT TOOLSThere are many different types of
components, some visible or others behind-
the-scenes, within an industrial automation
system network. A typical pharmaceutical
manufacturing setting involves multiple
PLCs and distributed control systems
(DCSes) controlling batch processing of
various compounds.
The PLCs and DCSes control the low-level
equipment: setting parameters, managing
I/O, opening and closing valves, etc.
Let’s say the PLC running a process per-
forms flawlessly 99 percent of the time.
Those trying to understand and fix the 1
percent failure may assume there is some-
thing wrong with the process and waste
much time trying to find the root cause.
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 20
On the other hand, cybersecurity monitor-
ing tools might recognize the failure was
caused by a network incident resulting
in a PLC misconfiguration, for example a
network traffic jam caused a momentary
bandwidth shortage resulting in dropped
I/O commands.
Looking at such a situation from a cyber-
security perspective, a hacker aware of
the incident might look for ways to repli-
cate this issue by causing a domain name
system (DNS) attack which would disrupt
various processes, resulting in lost batches
or worse.
IMPLEMENTING BEST PRACTICES FOR INDUSTRIAL SYSTEMSA common problem today results from
senior C-level managers trying to manage
data security using tools and solutions
designed for IT systems. They’ll direct the
team to install firewalls, anti-virus tools and
automated network patching. The CIO or
other high-level executive can’t dive into
the details of security risks in complex man-
ufacturing environments. The IT and even
OT networks may have sufficient cyberse-
curity protections, but not the PLCs and
DCSs actually controlling the processes.
The CIO might think everything is buttoned
up because their anti-virus platform is up to
date, but this often ignores the OT side.
Protecting the OT side often depends on
a solution able to detect anomalies within
industrial networks — a tool to monitor the
PLCs and DCSes that aren’t part of the typ-
ical corporate data network. Armed with
such a platform, engineers, control system
operators and network security staff can
have control over various threats with-
out restricting the facility’s productivity
or performance.
Ideally, such a solution continuously iden-
tifies and analyzes deviations from the
norm, so a pharmaceutical manufacturer
can eliminate risks to its IP and actual
product integrity. Additional context and
insights come from such a solution in terms
of how it relates to other systems concur-
rently operating within the manufacturing
plant. This type of solution gives meaning
to the other system by providing guidance
on what firewall rules should look like and
sending alerts when firewall functions are
out of baseline.
MANAGING THE SECURITY AND OPERATIONAL SIDESSome cybersecurity solutions only provide
protections and insight for the network,
but do not offer views into design flaws
or misconfigurations within the actual
production equipment. Returning to the
1 percent problem example with the PLC,
an advanced industrial control monitoring
solution provides this extra layer of
insight so network managers can catch
and stop small problems from becoming
costly catastrophes.
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 21
The implementation of such a solution is
critically important. When interfacing with
the environment to create a monitoring
point, the software will capture data from
the network, but it must not create traffic
itself. The solution is not hindering net-
work communications, it is instead simply
listening to the traffic and checking all of
the proprietary systems and protocols. The
objective is quick detection and remedies.
Even if a company can achieve an appro-
priate security level by introducing security
measures into the different domains, the
security level will decrease every day
because new malware is constantly being
created. Maintaining cybersecurity is a
dynamic and never ends. It must be part
of a sustainable security lifecycle sup-
ported by effective tools and constant
reassessment.
www.PharmaManufacturing.com
eBOOK: 2018 Smart Pharma 22