In Food & Beverage, Cybersecurity Is a Remote Access and Supply Chain Problem

Nearly 90% of respondents to a survey said one or more cyber attacks of the previous 12 months originated from third-party supplier access to the cyber-physical systems (CPS) environment. 41% said that was the cause of five or more attacks.

More than half (57%) admitted to having only partial or no understanding of third-party connectivity to their CPS environment.

Claroty, a cyber security provider, commissioned an independent global survey of 1,100 professionals involved in information security, operations technology (OT), engineering, clinical & biomedical engineering, and facilities management & plant operations. They were asked about the business impacts of cyber attacks on their organizations in the previous 12 months. 58 of the respondents work in the food & beverage sector; following are analyses of their responses.

“Frequent and disruptive cyberattacks have resulted in significant financial costs and operational disruptions, delays in service delivery, data loss and manipulations with far-reaching consequences for public safety and national and economic security,” a resulting Claroty report said.

When asked about the financial impact of cyberattacks to their organization, more than 70% of the food & beverage respondents reported a financial loss of $100,000 or more. Nearly 30% reported a loss of $1 million or more

Several factors contributed to these losses, the most common being legal fees (selected by 41% of respondents), recovery costs (36%), employee overtime (34%) and production shutdown (31%).

And of course there’s ransomware. 36% of respondents met ransomware demands of $1 million or more to recover access to encrypted systems and files in order to resume operations. “When considered alongside the hourly cost of downtime, it’s easy to understand how a cyber incident could quickly rack up tens of millions of dollars in financial repercussions if not resolved immediately,” the report concluded.

There were several operational impacts felt by organizations worldwide. Financial losses were cited by 36%, public safety by 22% and human injury at 19% were the most common impacts.

When asked about the confidence they have in their organization’s ability to withstand attacks today versus 12 months ago, most respondents (50%) cited greater confidence in the ability of their organization’s CPS — indicating a growing maturity around the defense of CPS environments and a deeper understanding of their impact on critical infrastructure.

Here at Food Processing, we've seen few reports of cyber breaches in the past year -- although just this month (December) two U.S. subsidiaries of Stoli Group filed for bankruptcy, in part because of a cyberattack. In July we carried a story from a PepsiCo executive titled "Top 7 OT Cybersecurity Challenges in the Food & Beverage Industry."