These examples demonstrate that whether it’s a data breach at a food distribution network, a malware incident at a food processing plant, or a phishing attack at a food retailer, cyberattacks can disrupt various points in the supply chain. Each disruption not only affects operational efficiency but also undermines consumer confidence in food safety, impacts profitability, and can result in data breaches and regulatory fines.

How to prepare for cyber-attacks and related supply chain disruptions?

While it is challenging and potentially misleading to claim specific preventative actions could have avoided past incidents, the following activities can help build safeguards and resilience in your system:

Implement cloud-based threat detection solutions, data backup, and response systems.
Conduct effective user training.
Perform penetration testing (mystery hacker).
Use Bitsight assessment to get a security score and benchmark your business.
Implement and specify ISO 27001, the international standard for information security management
Protect your supplier ecosystem by ensuring critical supplier facilities are audited and comply with regulations and best practice standards.
Foster a good cyber culture across the business.
Develop business continuity plans for supply disruptions.
Obtain cybersecurity and ransomware insurance.

Standards and mitigation strategies

Adhering to cybersecurity standards and frameworks like ISO 27001 is crucial for mitigating risks in digital supply chains and instills the discipline to do the right thing, embedding the necessary processes and culture.

In the food sector, cybersecurity is an essential part of food defense planning. With 50% of manufacturing processes run by software, facilities are vulnerable. The following standards and methods can enhance your digital security and that of your entire supply chain:

PAS 96 – Defending food and drink from deliberate attack.
TACCP – Threat assessment and critical control point.
VACCP – Vulnerability assessment critical control point.
US Food Safety Modernization Act – Intentional adulteration rule.
ISO 22001 food safety management [integrating cyber/information/data security as a risk for the hazard analysis and critical control point (HACCP), TACCP, and VACCP study]
Global food safety initiative (GFSI) food safety schemes such as FSCC 22000, brand reputation through compliance global standard (BRCGS), and safe quality food (SQF), all of which have provisions for cyber risk assessment.

It’s important to remember that employees cause over 95% of information security incidents. Therefore, establishing a strong cybersecurity culture is just as important as implementing IT security infrastructure. Training should include best practice such as:

Password control: Use strong, unique passwords, and password managers.
Phishing, malware, and ransomware awareness: Stay updated on phishing tactics and report suspicious emails.
domain spoofing and evil twin wi-fi: Verify website authenticity and avoid unsecured Wi-Fi.
Spear phishing and social media security: Recognize targeted phishing and avoid oversharing on social media.
Two-factor authentication (2FA): Implement 2FA for added security.
Regular software updates: Keep software and systems updated.
Data encryption: Encrypt sensitive data in transit and at rest.
Incident response training: Conduct regular drills for security incidents.
Physical security: Secure devices and workspaces.
Secure remote work practices: Use VPNs and secure communication tools.

Managing information and cybersecurity: A culture issue, not just a tech issue

Managing information and cybersecurity is a collective organizational responsibility.
Culture is key, and this needs to be driven by the C-Suite because everyone needs to be involved. It’s crucial to humanize the tech departments, recognizing them as integral parts of all business processes. If cybersecurity fails, many interconnected aspects of the business are impacted. This holistic approach must be championed by the chief executive officer (CEO) and the C-Suite.

Chief executive officer’s cyber priorities

Elevate the chief information security officer (CISO) to a position of authority
Understand the risks and set the tone and culture
Invest in best practice controls and benchmarking

Chief financial officer’s cyber priorities

Understand business risks and work with the CISO
Recognize that financial and cybersecurity risks are symbiotic
Be aware of general data protection regulation (GDPR) fines for breaches (EUR20 million or 4% of turnover)
Develop contingency plans for ransomware issues.

Chief marketing officer’s cyber priorities

Understand digital transformation and associated cyber risks.
Embed cyber risk training with sales, marketing employees, and consider risk in social media, websites and community engagement.
Foster a cyber-aware culture and collaborate with the CISO.

Chief operating officer’s cyber priorities

Understand operational risks and work with the CISO.
Embed a cyber-aware culture and good working habits into operations.
Collaborate with C-level executives for best practice solutions.

Establishing robust cybersecurity frameworks and promoting a culture of cyber awareness are crucial steps in mitigating risks and safeguarding supply chain integrity.

Conclusion

This article’s focus on the food sector and supply chain is intentional due to its critical nature and significant connection to national security. The food sector’s fast-paced and high-risk supply chains offer valuable lessons transferable to other industries like toys, textiles, fast-moving consumer goods, healthcare, automotive, aerospace, and manufacturing. The author’s extensive experience across sectors highlights the universal applicability of robust cybersecurity practices.

As supply chains evolve with digital transformation, cybersecurity risks become paramount, especially in the food industry. Prioritizing cybersecurity awareness, stringent standards, and advanced technologies is essential for navigating digital supply chains and safeguarding against cyber threats.

Key points:

Data, technology infrastructure, and information security are critical assets
Cyber risk increases with the use of technology and IT platforms
Cybercrime is constantly evolving
All supply chain sectors are vulnerable to high-impact cyber threats
Cybersecurity is an organizational issue, with over 95% of incidents caused by employee error
Cybersecurity training is crucial for establishing awareness and culture
Integrate cybersecurity into product quality and safety planning, such as food defense planning

Recommendations:

Comprehensive cybersecurity training: Educate employees on best practices and threat mitigation.
Advanced threat detection and response systems: Use cloud-based security solutions and proactive monitoring.
Penetration testing: Regularly test systems for vulnerabilities.
Bitsight assessment: Benchmark your business with a security score.
Adherence to standards and regulations: Implement frameworks like ISO 27001.
Collaborative partnerships: Share information with industry peers and experts.
Continuous improvement: Regularly update cybersecurity protocols.

By adopting these measures, businesses can enhance their cybersecurity resilience, mitigate cyber threats, and ensure the reliability of digital supply chains. Everyone in the supply chain must be vigilant and implement best practices and certifications, with ISO 27001 being a good starting point.