In today’s manufacturing landscape, cybersecurity is no longer an afterthought—it’s a foundational business imperative. As cyber threats have grown in sophistication and frequency, the concept of Secure by Design has emerged as a critical framework for safeguarding not only products, but also the complex web of third-party suppliers that underpin modern industrial operations.
The Threats Driving Secure by Design
The past decade has seen a seismic shift in the threat landscape. High-profile breaches—from Target’s infamous HVAC vendor incident to ransomware attacks that crippled global supply chains—have made it clear that attackers are adept at exploiting the weakest link, whether it’s a software vulnerability, an unpatched device, or a trusted supplier with lax controls.
For manufacturers, this risk is compounded by the convergence of IT and operational technology (OT), the proliferation of IoT devices, and the increasing reliance on cloud-based services. Printers and other networked endpoints, once considered innocuous, have become prime targets for cybercriminals seeking entry into corporate networks. According to Quocirca’s 2024 Print Security Landscape report, 67 percent of respondents experienced at least one print-related data breach in the past year, an increase from 61 percent in 2023.
As a result, Secure by Design is no longer just a technical aspiration; it’s a strategic necessity. This approach embeds security principles throughout the product lifecycle—from initial design and development to deployment, maintenance, and end-of-life—ensuring that security is not bolted on, but built in.
The Maturity of Hardware Manufacturers
The good news is that awareness of these risks has driven significant progress among hardware manufacturers. Industry leaders now embrace Secure by Design as a core tenet, integrating secure development lifecycles (SDLC), regular vulnerability testing, and robust supply chain oversight.
At Lexmark, our journey began with customer demand. In the mid-2010s, we formalized our security policies and processes, recognizing that customers were asking increasingly sophisticated questions about both our products and our supply chain. We adopted industry best practices—drawing inspiration from frameworks like Microsoft’s SDL and ISO standards—and tailored them to our culture and products.
Key elements included mandatory developer training, threat modeling, static and dynamic code analysis, rigorous open-source component evaluation, and layered security testing. Importantly, we required executive sign-off on security evidence before any product release—a step that ensured accountability and buy-in across the organization.
But Secure by Design extends beyond internal development. It demands a holistic view that encompasses IT infrastructure, build pipelines, and—critically—the third-party vendors and contract manufacturers who contribute to the final product.
Based on industry research and practical experience, here are five best practices manufacturers should consider when building or maturing a Secure by Design program:
- Make Security Everyone’s Responsibility. Security cannot be the sole responsibility of a dedicated team; it must be woven into the fabric of the organization. Invest in role-specific training, empower security champions across departments, and ensure everyone—from R&D to procurement—understands their role in protecting the business.
- Formalize and Enforce Secure Development Lifecycles. Adopt a structured SDLC that includes:
- Mandatory security training for developers.
- Threat modeling and architectural reviews for new features.
- Automated code analysis and vulnerability scanning.
- Rigorous evaluation of open-source components.
- Regular penetration testing and red-teaming exercises.
- Continuously improve this process based on emerging threats and lessons learned from incidents—both internal to your company and those happening to your peers in the industry.
- Protect the Entire Product Ecosystem. Security doesn’t stop at the product boundary. Safeguard build environments, code repositories, and communication channels used by developers. Implement strong access controls, monitor for anomalies, and maintain hygiene in all supporting systems.
- Integrate Third-Party Risk Management Vendors and contract manufacturers must be held to the same high standards as internal teams. Key steps include:
- Risk-based segmentation of suppliers.
- Requiring security attestations (e.g., SOC 2, ISO 27001) where appropriate.
- Using standardized questionnaires and independent scoring services.
- Performing on-site audits for high-risk partners.
- Embedding security requirements in contracts, including SLAs for vulnerability remediation. At Lexmark, for example, we personally audit our contract manufacturers, reviewing everything from component quality inspections to IT system controls on the production line.
- Plan for Resilience and Transparency. No security program is infallible. Prepare for incidents by developing robust response plans, conducting tabletop exercises, and ensuring clear lines of communication—internally and with customers. When vulnerabilities are discovered, disclose them promptly and provide actionable guidance for mitigation.
Secure by Design as a Competitive Advantage
Regulatory pressures—from NIST guidelines to SBOM (Software Bill of Materials) requirements—are raising the bar for product security across industries. But forward-thinking manufacturers recognize that Secure by Design is more than compliance; it’s a differentiator that builds trust with customers, partners, and regulators alike.
By making security a foundational element of product and supply chain strategy, manufacturers can reduce risk, accelerate innovation, and strengthen their market position in an era where resilience is paramount.
The journey to Secure by Design is ongoing, and every organization’s path will be unique. But by embracing a holistic, proactive approach—and learning from both successes and setbacks—we can collectively raise the standard for security in manufacturing.
Bryan Willett is Chief Information Security Officer (CISO) at Lexmark.
