New report reveals growing threat of cyber-attacks to food safety
A new report has warned that the food industry is vulnerable to cyber-attacks which could result in risks to public health.
A new report by University of Minnesota researchers has illustrated the mounting cyber-security risk facing the food industry. The potential consequences of an attack on the industrial control systems used in the food industry include contaminated food that threatens public health, physical harm to workers, destroyed equipment, environmental damage, and massive financial losses for companies.
The systems companies use for processing and manufacturing food contain many vulnerabilities that experts believe will soon present a more appealing target for cyber-attacks than industries that are more commonly affected by, and therefore better prepared for, such attacks.
“The food industry has not been a target of costly cyber-attacks like financial, energy, and health care companies have,” said Stephen Streng, lead author on the report. “However, as companies in those sectors learn to harden their defenses, the attackers will begin looking for easier victims. This report can help food companies learn about what could be coming their way and how to begin protecting themselves.”
Over 200 industrial control system vulnerabilities were identified in 2011, the report notes, with the number increasing each year through 2016, the end of the study period. The vulnerabilities are present in a wide variety of components from different vendors, making them difficult for companies to avoid.
Many systems were designed before cyber-security was a concern and use outdated operating systems and hard-coded passwords that allow attackers easier access to the system.
Further factors that contribute to the heightened risk of cyber-attacks in the food industry are:
- A lack of knowledge about how industrial control systems and IT systems interact
- A lack of awareness about cyber-risks and threats
- Poor coordination and information-sharing among food system stakeholders
- The tools required to carry out a cyber-attack are becoming more powerful and require less skill to use.
Moving forward, the report recommends that the food industry foster stronger communications between operations technology and information technology staff. Also, to conduct risk assessments that include inventories of both industrial control and IT systems, involve staff with cyber-security expertise in procuring and deploying new industrial control systems, and extend the existing culture of food safety and defense to include cyber-security.