Basic Cybersecurity Deters Agro-Terrorism

A Deloitte survey found that, while 90% of food & beverage manufacturers reported the ability to detect cyber events, very few have extended monitoring into their operational technology environments.

The food & beverage industry needs to lift its cybersecurity game as it becomes a popular playground for hackers. 

By Cody P. Bann, Win911

Connectivity provides manufacturing plant operations many advantages such as increased productivity, faster identification and remediation of quality defects, and better collaboration across functional areas. However, this connectivity is dramatically increasing smart-factory vulnerabilities and leaving them exposed to cybersecurity threats. In a recent survey by Deloitte, New York City, and the Manufacturers Alliance, Arlington, VA (manufacturersalliance.org), 48% of respondents identified operational risks, including cybersecurity, as the greatest danger to smart-factory initiatives. 

Food & Beverage Vulnerability

Food & beverage processing plants are under particular assault. According to Trustwave, Chicago (trustwave.com), a leading data security firm, food & beverage was the third most compromised industry after retail and hospitality, accounting for 10% of all attacks. While that number may seem small compared to the massive breaches reported recently by news outlets, it’s important to understand that 70% of hacked food & beverage companies go out of business within a year of an attack (“Risky Business: Cyberattacks on the Food Supply,” Capstone Logistics). 

The size of these companies doesn’t seem to matter to the attackers. According to the Federal Bureau of Investigation (FBI), “Larger businesses are targeted based on their perceived ability to pay higher ransom demands, while smaller entities may be seen as soft targets, particularly those in the earlier stages of digitizing their processes” (“Why Cybersecurity is a Major Concern for Food Firms in 2022,” Powder & Bulk Solids, February 4, 2022). 

A few of the attacks that have occurred in the past year:

• Molson Coors, Chicago, experienced a systems outage that disrupted its brewery operations, production, and shipments.

• An unidentified U.S. bakery company suffered a ransomware attack in July 2021. The attack interrupted its operations for a week as the firm could not access its network ahead of the important Halloween season.

• Ferrara Candy, Chicago, maker of SweeTarts, Nerds, and Boston Baked Beans, was attacked by cyber criminals. They compromised the firm’s computer system, disrupting operations for several weeks.

• JBS, Beardstown, IL, had their North America operations shut down and paid an $11 million ransom (Powder & Bulk Solids, Feb. 4, 2022).  

The food supply’s vulnerability is not lost on the U.S. Department of Homeland Security, which considers the entire Food & Agriculture industry one of the 16 national critical infrastructures. This designation has generated attention for a new type of cyber threat called agro-terrorism: deliberately contaminating the country’s food supply, with the intent to terrorize and harm people (Capstone Logistics). 

Surprisingly, a significant share of manufacturers has yet to build the cyber capabilities to secure some of these business-critical systems. Deloitte’s survey found that, while 90% of manufacturers reported the ability to detect cyber events, very few have extended monitoring into their operational technology environments. 

Integrating remote alarm notification software with the SCADA system is critical to reducing cyberattacks.

Remote Notification Software

The majority of technology and software vulnerabilities can often be found in remote access to networks, insufficient security configurations, outdated firewalls, weak passwords, and a lack of proper staff training. It’s ironic that, as manufacturing plants adopt more smart technologies to increase production and efficiencies, cyberattack risks escalate. Coincidentally, turning to additional technology is one answer to address this challenge. 

Many SCADA systems are simply over-exposed to the internet by remote desktop applications. In an attempt to offer process and asset information to operators, organizations have provided much more, ignoring the principle of least privilege, and opening their entire control systems and hosts to remote desktop access by unnecessary parties. Such broad remote-access techniques present an increased security risk for companies.  

Advanced remote alarm notification software allows remote operators access to only the information they need from SCADA, but not access to the SCADA itself or its operating-system host. Such notification software is compatible with more secure, layered networks in which a series of firewalls provide added protection from attacks. This is done by deploying notification solutions alongside the SCADA system at the network’s control level and using notification modalities that are not internet facing or distributing internet-facing notification processes to higher levels. Likewise, separating the processes that interface with SCADA from those that interface with external email servers, VoIP solutions, and cloud apps allows internet-based notifications without compromising security.

Of course, there are valid use cases for desktop-sharing software that do not violate PoLP (Principle of Least Privilege) and go well beyond operator access to process information. For such systems, it’s critical that the remote-desktop solutions be implemented with sound security.

There are several steps that manufacturers should take to improve their cybersecurity:

• Update any software to the latest version.
• Deploy multifactor authentication.
• Use strong passwords for remote-desktop protocol credentials.
• Ensure anti-virus systems, spam filters, and firewalls are up to date, properly configured, and secure. 

Manufacturers should also take steps to secure any remote-access software. They should not use unattended access features and IT leaders should configure the software such that the application and associated background services are stopped when not in use. Integrating remote alarm notification software through the SCADA system is critical to further reducing cyberattacks.

New Normal

While cybersecurity is rarely recognized as a food-safety issue, the systems companies use to process and manufacture food contain many vulnerabilities that experts believe will soon present a more appealing target for cyberattacks than industries that are more commonly affected by, and therefore better prepared for, such attacks (“Adulterating More than Food: The Cyber Risk to Food Processing and Manufacturing,” Food Protection and Defense Institute, September 2019). 

Automation and connectivity increase productivity and allow companies to focus more on innovation. However, these technologies also create new security challenges, expose unprotected industrial control systems, and heighten cyber risks. The scope of the threat is growing, and no organization is immune. Companies must reinforce their defenses and understand the myriad technological tools that will help them combat the ever-growing cyber threats. EP

Cody Bann is director of engineering at WIN-911, Austin, TX (win911.com). The company helps protect more than 19,000 facilities in 85 countries by delivering critical machine alarms via smartphone or tablet app, voice (VoIP and analog), text, email, and in-plant announcer.