Given the current state of globalization and the recent pandemic, having an efficient supply chain is more important than ever before. The transportation and supply chain industry plays a vital role in our economy by ensuring that raw materials as well as finished products are delivered to those who need them promptly.
The digitization of logistics companies has drastically improved efficiency, creating opportunities for expanding revenue streams. But with the many benefits it comes with, it has also highlighted some weaknesses in logistics that make them highly susceptible to cyber-attacks. All areas of the industry are affected by this, including maritime, trucking, rail, logistics providers and package deliverers. Not only is a data breach expensive and disruptive, but it could also create legal issues, especially if customer information is exposed.
Any industry that relies on cloud storage is a potential target for cyber-attacks, including the logistics industry which is currently experiencing its golden age due to the COVID-19 pandemic.
Intel 471 researchers discovered that some network access brokers were selling credentials of logistics companies. They went on to say that if this crisis continues, it will have disastrous effects on the global consumer economy. Cybercriminals have reportedly stolen login credentials by exploiting weaknesses in remote access solutions.
Expeditors International - the world's sixth-largest freight forwarder - is the most recent prey to a cyberattack. The Seattle-based company that made $10.1 billion in revenue last year, says it stopped most of its systems around the world after the cyberattack. It limited operations and used backups to restore systems. But this is typical behavior for businesses experiencing a ransomware attack.
The IT infrastructure at ports in Belgium and the Netherlands was affected in February this year. Also, Hellman Worldwide Logistics suffered an apparent ransomware attack last December, leading to clients being targeted with fraudulent communication.
Ransomware has hit some of the world's biggest carriers hard in recent years. NotPetya famously took down A.P Moller-Maersk and caused an estimated $300 million dollars in damages. Three other large companies have also been infected by ransomware in past five years.
Swissport claimed that the BlackCat ransomware group carried out a ransomware attack which affected IT systems, in yet another example of cyberattacks within the logistics industry.
Forward Air's speciality was targeted by a phishing campaign which cost the company approximately $7.5 million lost in revenue globally (USD). Even though these companies have gone through difficult times they are still operational and hopefully will continue serving their consumers well into the future.
There are several large logistics companies which fell prey to cyberattacks, but it doesn't imply that small companies must take a backseat. Being proactive about potential cyber threats by identifying security vulnerabilities and taking precautions can help prevent future attacks.
Interestingly, the logistics industry is not as prepared for cybersecurity threats as it should be. This is made worse by the fact that companies in this industry are part of a larger supply chain and need to connect their networks and systems to vendors, suppliers, and partners – who also need to have secure systems.
A 2019 report from EFT (now Reuters Events: Supply Chain) showed that a majority of logistics service providers lack a Chief Information Security Officer, with only 21% who thought that they needed one. Moreover, almost 55% of employees state that they are unprepared to handle a cyberattack.
To create a cybersecurity agenda, logistics companies should first determine the level of cyber protection currently in their IT and OT equipment and programs. They can then find critical vulnerable applications and networks to establish safety. Using models and tools, such as cyber risk management and quantification programs, can help map exposure to cyber-attacks and identify a portfolio of protective initiatives.
Companies should sort their vulnerabilities using a risk-based approach that gives priority to the probability and impact of security threats on critical assets. Companies can prioritize projects based on their ability to improve resiliency in relation to cost, allowing them to make the most of their cybersecurity investment budget.
By taking these safety measures, Logistics companies can focus on adopting more innovative cyber protection concepts, such as zero-trust architecture. This methodology assumes that any device, user, or application trying to engage with the network could be a potential danger.
A zero-trust strategy can ensure the safety of your network by utilizing DMZ technology. By controlling and monitoring the connections in and out of the organization, companies can create a trustless environment where no one is trusted. To improve security, businesses should confirm the identity of users, programs, and devices before giving them permission to view sensitive data or applications.
To start, change the company culture to one that recognizes how crucial cybersecurity is. This needs to be an open topic of discussion in every department so that everyone understands their role in reinforcing it organization-wide. To have a workforce that is aware of risks, it is important to conduct frequent cybersecurity-awareness training sessions. You must reinforce the importance of individual actions they can take to protect against hackers, such as being cautious with passwords and monitoring company networks for any suspicious activity.
Next, use this new focus on cyber-risk management to recruit cybersecurity professionals from universities and the private sector. Publicize that your organization aspires to be a proactive leader in the cybersecurity industry. Companies can better their cybersecurity by promising potential employees that they will have the chance to work with cutting-edge technology and start fresh rather than using outdated legacy systems. Also, companies should get advice from vendors who aren't looking to make a quick buck but rather want unbiased help.
Lastly, determine which employees in the company are interested in participating in cybersecurity initiatives and who have demonstrated they have the basic skills required for success. If logistics companies provide their current employees with financial compensation and better job titles for developing the required cybersecurity skills, they will be able to fill at least some of their workforce needs quickly.
For logistics companies, managing cybersecurity risks may feel like a lot, but one way to make IT and OT networks more secure is by setting up a cyber fusion center. This center will help protect against cyber threats by monitoring and managing data and intelligence sharing among key players.
In short, a cyber fusion center would make operations more efficient by having IT and OT management work together in the same space. This way, both sets of professionals can keep an eye out for any unusual behavior on the internet or internally that could be signs of an upcoming attack. To combat risk, logistics companies should establish several layers of cyber resilience that maintain high-security standards, protect partner supply chains, and adopt approaches based on the amount of risk when designing security controls. Companies need tools that will measure different areas to help them become more cyber-resilient. This includes everything from people and processes to regulations and technology.
Many logistics and transportation companies overlook the importance of cybersecurity, often due to the fact that their company's users are spread out, not working on controlled networks, and have a lot of outside partner interaction.
Companies need to take active steps in order to reduce the chances of cyberattacks. This includes ensuring secure remote access and network segmentation, among other solutions.
A company's success depends on its leadership's dedication to carrying out the steps, many of which are interconnected and require a monetary investment.
In the past, many logistics companies have neglected proactive cybersecurity policies. However, the recent proliferation of cyber-attacks and new regulations are beginning to sway firms towards taking a more active stance. As hackers become bolder and more sophisticated, they are also becoming better at targeting companies that have weak cybersecurity measures. This is not a list that any company wants to be on.
To protect customers and operations, logistics companies need to start taking proactive steps to improve their cybersecurity posture. This includes everything from educating employees on identifying threats to investing in quality hardware and software. By doing so, they can make it next to impossible for cybercriminals to target them and disrupt their business.