“Baseline security measures needed” as cybercrime hits the food industry, expert says

As shown by the recent ransomware attack on meatpacker JBS SA, agricultural businesses are not exempt from cybercrime.

In a press statement, JBS USA said it paid an $11 million ransom to cyber attackers that shut down operations in the U.S. and Australia in early June.

JBS said in the statement that the vast majority of the company’s facilities were operational when the ransom was paid.

The payment, made in bitcoin, was intended to prevent further disruption and to limit the potential impact on restaurants, grocery stores and farmers that rely on JBS, said Andre Nogueira, CEO of the company.

Industry position

All companies are at risk from cyber-attacks, said Greg Gatzke, president of San Jose, Calif.-based ZAG Technical Services Inc., noting the near-total reliance of the produce industry on web-based transactions.

“Every company is a technology company, and that’s what people have to realize,” he said.

There are typically two ways attacks come to businesses, he said. One is ransomware, which has hit JBS, Colonial Pipeline and many other companies. The other type of attack, he said, is when cybercriminals exfiltrate data, or take data out of a network and use it to leverage ransom. 

“The risk there is if there’s any personal identifiable information that gets taken out, that there can be legal issues tied to that,” he said. 
Another fairly common type of attack is when a cybercriminal poses as a supplier and tells the shipper that it has a new bank routing number, which he said can be a very costly scam.

Gatzke said ransomware attacks on companies started around 2008 -10; before that, companies were living in “the good old days” of straightforward computer viruses.

“I think cryptocurrency really enabled all of this,” he said, noting that digital currency allows criminals to receive payments without any traceability.

First steps

Companies should make sure their technology does not make it easy for criminals to access their networks, Gatzke said. While not discussing specific cases, Gatzke said ZAG has been involved in helping produce companies recover from a cyber-attack.

Criminals can use a remote access tool called RDP (remote desktop protocol) to get into a network. While the older RDP technology is less common today, Gatzke said he still sees companies compromised by it.

“It is surprising to me that anybody still has (RDP), but they still do,” he said.

One way to safeguard computer networks is multi-factor authentication, which is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence to an authentication mechanism.

Companies should strive to be in a position to know they are being attacked before data has been taken out and the cybercriminals are demanding ransom.

“Number one is to know that (companies) have been attacked as early as possible,” he said. “Ultimately, you need to have, first of all, an incident recovery plan.”

Questions must be considered, such as, a) How is the business going to ship? b) How is the company going to label things? 
“All those key things that everybody relies on the Enterprise Resource Planning (ERP) system today to do, you’re not going to have that during the initial start of the attack,” he said.

Cyber-attacks typically come in the morning, he said. When the attacks come, companies must have an Incident Response Plan.
“How are they going to communicate with customers? Are they going to communicate with the customers? Are they going to communicate with law enforcement?”

Beyond all that, Gatzke said companies need to have a plan as quickly as possible.

ZAG Technical Services advocates a technology called snapshots, which are periodic backups on computer servers.

“It allows you to step back before the attack, and recover systems,” he said. “So, we’re able to help people get up as quick as possible, and I’m going with the caveat that you never want to pay the criminals.”

Gatzke said if companies take the “snapshot” approach to backing up their servers, they can often be restored faster than if they pay cybercriminals the ransom.

Looking ahead, Gatzke said the issue of cybercrime is constantly changing.

“Unfortunately, the criminals are always evolving; they find new avenues and new methods,” he said. “The way they’re doing it now didn’t exist two years ago.”

Gatzke said protection schemes must keep evolving with the criminals.

“I believe the industry needs to come together to help establish a baseline of security,” he said. 

Just as the Leafy Greens Marketing Agreement helped establish food safety standards, a cybersecurity industry group could help establish a relative level of security and recoverability.

“I hope we do it before the government makes us do it,” he said.

See: As food production moves to automation, is more of the food supply at risk of cyberattacks?