Why food & beverage companies should crack down on Cyber threats to ICS

Why food & beverage companies should crack down on Cyber threats to ICS

When we buy groceries at the supermarket, most of us check the ingredients and expiration dates of packaged goods.

But how can we be sure that the products we bring home are safe to eat and drink?

Naturally, food and beverage (F&B) manufacturers have a vested interest in ensuring the quality and safety of their products.

The impact of a tainted product reaching the market can be devastating, both in terms of public health and brand reputation. In fact, recent FDA rules require companies to implement cybersecurity mitigation strategies aimed at protecting food against intentional adulteration.

Food safety can be compromised by various sources, from disgruntled employees to politically-motivated sabotage and even acts of terrorism. Cyber threats aimed at F&B companies’ ICS networks also pose a risk to manufacturing processes and can lead to a wide range of food safety and operational issues. Unfortunately, most F&B companies’ cyber security strategies overlook the risks to their industrial control processes.

F&B Manufacturing & Cyber Threats: What’s at Stake?

Any unauthorized change to an ICS controller – due to a sophisticated cyber attack or an innocent human error – can result in the production of tainted and unhealthy products, and the price of such an error can be exorbitant.

Throwing out a production batch due to incorrect ingredient ratios, altered sugar levels or milk temperature, for example, can cost F&B companies millions of dollars. Imagine the implications of a wrong ingredient finding its way into a breakfast cereal that causes an allergic reaction in children. As a result, food safety dictates zero tolerance for unintended changes to manufacturing processes.

In the event of a safety issue, F&B companies have no choice but to shut down the relevant production line until the problem is sorted out.

For a global F&B manufacturer in the UK that subsequently became an Indegy customer, the cost of shutting down a single production line in terms of lost revenues was approximately £48,000 per hour, or more than £1 million per day. As F&B manufacturers typically operate 24×7 and operate multiple production lines, downtime costs due to an ICS-related cyber incident can be astronomical.

Automation Technologies are a double-edged sword

ICS networks are more vulnerable to cyber attacks than their IT counterparts. This is due in large part to the fact that most ICS networks were designed decades ago, well before cyber security became a concern. Thus, while ICS network face the same cyber risks common in IT environments, they suffer from an absence of basic security controls and the lack of automated asset management capabilities.

This vulnerability has been exacerbated in the F&B industry by manufacturers’ increasing reliance on automated industrial control systems to process, store, and manage large product volumes. In recent years, new connected technologies such as IIoT (Industrial IoT) devices have been introduced into these systems to improve supply chain analytics and enable predictive maintenance.

While automation and connectivity increase productivity and allow companies to focus more on innovation, these technologies also create new security challenges, expose unprotected ICS systems and heighten cyber risks.

More about industry 4.0 in food and beverage industry

The inherent risks of ICS networks to cyber attacks can be attributed to the following factors:

• OT networks were not designed with security in mind, meaning that industrial controllers are not typically protected with authentication, encryption, authorization, or other standard security mechanisms.
• A successful cyber attack on an OT network could have product quality and safety implications as well as financial, legal and environmental ramifications.
• It is much more difficult to monitor OT networks than it is to monitor IT networks because of the lack of monitoring tools, the proprietary protocols in use, and network isolation.

In addition, the fact that control systems within a food manufacturing facility are often networked into other company IT systems (e.g., administrative, financial, ERP) increases their exposure to a cyber attack. As such, a single breach to any IT or OT device puts the entire ICS network at risk.

Internal and External Security threats to F&B operations

Low-security ICS networks are low-hanging fruit for traditional hackers, cyber criminals for hire, or even nation-states. However, while external cyber attacks that steal data grab headlines, most manufacturers believe that the main threat comes from insiders.

Within this category, the leading cause of operational downtime is human error, followed by malicious insiders who can also tamper with these systems.

Innocent mistakes and negligence on the part of trusted employees, contractors and integrators, such as making changes to the wrong PLC, or incomplete maintenance to DCS systems, can trigger a variety of disruptions, downtime and tainted food products.

Cyber Risk Awareness is the first step to prevention

Until now, most F&B manufacturers have shown little awareness regarding the risks to food safety and manufacturing processes from cyber attacks. This is partly due to the minimal levels of reporting of actual cyber events within the industry.

Reinforcing the perception of low risk is that the FDA does not see cyber systems as a component of food safety risk. Certainly, the FDA supports private sector’s need to secure technological systems from attack, but they do not specifically include these systems in their FSMA rules or guidance.

However, the truth is that cyber attacks represent a serious risk for F&B companies. They can disrupt manufacturing processes, take down a production line and result in tainted and unhealthy products reaching the public. The financial impact of such an incident can easily run into millions of dollars.

To protect themselves from cyber threats, F&B companies must ensure that their industrial control systems environments are protected from unauthorized intervention and that all changes to production devices are tracked and monitored.

 

This article was written by Barak Perelman, the CEO and co-founder of Indegy, a leading industrial cyber security company. Prior to Indegy he led several multi-million dollar cyber security projects at the Israel Defense Forces (IDF). He is a graduate of the elite Talpiot military academy and has over 15 years of hands-on experience in cybersecurity and protection of critical infrastructures. Originally the article appeared here.