Supply Chain Cybersecurity Risks

[Eric_LEMAIRE]

Cybersecurity is an issue that concerns every industry. Global supply chains are no exception. Although data breaches have been on the rise for the last several years for companies in every sector, supply chain leaders also need to contend with their data being used in the real world for theft, along with the threat of corporate espionage that risks having sensitive information exposed.

As supply chains grow more and more connected, so do the risks to network security. Although IoT technology has allowed for huge strides in efficiency, cost-savings, and connectivity in manufacturing and logistics, the trade-off it seems, is the vulnerabilities a connected supply chain is left open to. Let us examine some of the major cybersecurity risks that are posed to a connected supply chain’s IoT network and the security practices your organization can implement to best mitigate them.

Employee Theft

Theft is nothing new to the logistics industry. Every year, roughly $15 billion worth of merchandise disappears from freight yards, warehouses, and manufacturing plants. This theft has been curbed over the years thanks to cleverly placed IoT sensors that alert security personnel to where shipments are located at all times. They can also be tracked from any location with a little help from GPS tracking and PIM software.

The problem arises when disgruntled employees or hackers begin using these security measures against the business. In the event of a data breach, thieves have all the necessary information to know where a shipment is located, where it came from, where it is headed and what it contains (or at least its value). This is a situation where a cybersecurity flaw opens up the risk of a real-life threat.

To reduce the probability of your IoT data being used against your supply chain, security protocols need to be deeply ingrained within warehouse personnel’s habits and systems. Passwords for scanners, computers, and alarm systems need to be changed at least every 30 days and businesses need to encrypt sensitive information to reduce supply chain vulnerabilities within the network.

Two-factor authentication also needs to be present on all digital devices. Employee badges or keycards are good options for tokens, as employees require them to enter a worksite. This will ensure that personnel can be identified whenever a computer or piece of equipment is used.

Employee databases must also be kept up-to-date regularly. When a worker resigns from their post or is fired, their keycards must be deactivated within 24 hours and all security tokens must be accounted for.   

In a connected IoT world, cybercrime can lead to real-world consequences unless the proper precautions are taken to protect supply chain operations.   

Corporate Espionage

Approximately 20 percent of all European companies have suffered from some form of corporate espionage. And the problem is unfortunately only getting worse. Due to the interconnected nature of today’s supply chains, they make a perfect target for corporate espionage. Between the level of secrecy that surrounds complex manufacturing operations and the money that goes into protecting corporate intellectual property, supply chains have a lot of sensitive information to offer to the right buyer on the dark web. To make matters worse, unlike ransomware attacks, corporate espionage attempts often leave little evidence behind to prove that there ever was a breach.

To prevent corporate espionage and associated cyberattacks, an IT department needs to reserve the right to be able to purge users when necessary. Access must also be revokable to specific users and external devices at a moment’s notice. If an unwanted user attempts to gain access to sensitive data from another part of the IoT network, IT administrators need to be able to identify them and isolate themselves from the rest of the network.

Collaboration is a must across IT departments if a corporate espionage data breach ever occurs so that the breach can be traced back from its original source and the scope of damage done can be properly assessed. In a connected IoT world, communication is the key to success.

Weak Third-Party Supplier Security

A supply chain is only as strong as its weakest link. Unfortunately, when dealing with large networks and a variety of suppliers, distributors, and transporters, not everyone is subject to the same quality level of security protocols. With so many interconnected IoT sensors, a data breach in one part of the chain can have widespread consequences for an entire IoT network.

This is where security audits and establishing security protocols among suppliers and partners become crucial. IT administrators need to dictate to suppliers what basic security systems need to be in place and IoT developers need to create applications using one cohesive, open platform that allows all types of sensors and software to connect without creating gaps in a network’s security. Mandatory updates on firmware and software need to be enforced before allowing strategic partnerships to go forward, so as to avoid exposing any party to unnecessary risks.

IT administrators and industrial engineers should also consider override protocols and demand access to cybersecurity controls if ever one part of the network becomes compromised. This way, they can purge unwanted users from the network and minimize infections from an outside attack.

There also needs to be established protocols in place in the event that an attack begins in one area of an IoT network and starts spreading to other parts. IT departments need to be in constant communication with each other so that if a breach occurs at one end, the other sections can be notified immediately. This can even be achieved through automation if the network is in-synch.

With so many devices connecting together across vast IoT networks, third-party vendors and suppliers need to be held to the same standard of cybersecurity protocols across the board.

Threats to Food Supply Chains

When one thinks of primary targets for a cyberattack, banks, smart hospitals, and airports seem like more obvious targets. However, in an era of cyberterrorism where enemies of a state and cybercriminals will try their best to cripple a nation’s resources, food manufacturing supply chains have become a very convenient target.

With the introduction of 5G technology in food processing plants and an increased presence of robotic technology, virtually every step of a food manufacturing process can be automated. All of this connectivity and factory automation also opens up the risk of having a system compromised from virtually any connected device with a security flaw. Even more dangerous is the potential for food tampering within a connected food supply chain.

It is of vital importance that food manufacturers invest in food safety traceability software. Traceability software allows a processing plant or supply chain partner to pinpoint exactly where contamination may have occurred throughout the supply chain and ensure that proper cleaning procedures and sterilization practices have been followed. EcoStruxure™ Clean-in-Place Advisor from Schneider Electric offers such capabilities, and allows a manufacturer to collect data from CIP operations in real-time to ensure that a food manufacturing supply chain remains secure, even after a breach or cyberattack.

Although no supply chain’s cybersecurity can ever be flawless, there are steps manufacturers can take to decrease the likelihood of a data breach and ensure that the damage is limited if an incident occurs.

For more information on connected IoT networks and how business leaders can improve supply chain risk management, explore the Schneider Electric Exchange community.

First look on Exchange

Sources: 

Industrial & Warehouse Security: put a stop to theft and pilferage

10 Myths and Misconceptions About Industrial Espionage

IOT IN HEALTHCARE: BENEFITS, CHALLENGES AND APPLICATIONS