Warehouse Security Part 3 – Common Cybersecurity Threats

There is no doubt that cybersecurity is needed to protect your warehouse or 3PL from hackers. In this final installment of a three-part series on warehouse security threats, we will highlight the most common cybersecurity threats a distribution center may face and explore the risks associated with each. From outside sources stealing sensitive information like customer passwords (and selling them on the dark web) to ransomware attacks that delete or hold all the data stored in networked storage devices, every warehouse or 3PL can be at risk.

What is Cybersecurity?

To understand potential threats your 3PL or warehouse could face, you first need an understanding of how modern technology risks can impact your business operations. CISCO states that cybersecurity is the practice of protecting systems, networks, and programs from unauthorized access and attacks.

Cyber attacks include infiltrating an operating system and changing or destroying important information with malicious code; extortion; or actually shutting down day-to-day operations through cyber access. It’s important to understand common cybersecurity threats criminals use that could steal sensitive data and potentially harm your warehouse or 3PL.

5 Common Cybersecurity Threats

Cyber attacks can come in many forms. They might be like those pesky scams or robo-calls trying to get your attention every other day. What do they want? It could be anything from saying your warehouse owes money to the IRS or that your company car warranty has expired; likely neither is true.

These fraud examples actually may work in tangent with legitimate messages or other forms of communication like phishing emails that may be hard to detect. Here are some general examples:

1. Remote Control of Work or Personal Computers

Hacking is a crime that can target both individuals and businesses. These cyber criminals or hackers will often pretend they are from an important supplier, bank, or business partner reporting there is a problem with your system or account.

Once they gain your trust, the criminal will offer solutions like letting them gain remote access to your system with your password. They will then steal sensitive data, upload malicious code, and/or drain your bank accounts. It’s a trick that can be used to target individuals as well, but it is true potential only emerges when it is deployed against businesses like warehouses and 3PLs.

2. Ransomware Attacks

“Ransomware is the crime most organisations need to prepare for and is the most difficult to recover from,” according to Alan Woodward, Professor of Cybersecurity at the University of Surrey. “Businesses have to assume it’s a case of when – not if – it’ll happen and have a business continuity plan that allows the business to continue to operate and to reinstate a trusted version of the systems and network,” he said in an article in Raconteur.

The ultimate goal of a ransomware attack may vary based on the mindset of a cyber-criminal, but all seek financial gain. They hijack your company infrastructure – possibly through malicious code – gain access to your operating system, and lock all authorized company users out. During that time, they may steal information or sensitive data or simply keep your company locked out until you pay the ransom.

This is an especially worrying danger for warehouses, 3PLs, and their clients. Hackers now will target a vulnerable supplier of a larger company rather than the actual company itself. The attack is successful if the smaller supplier has sensitive information or confidential data on the larger company, or a connection that would enable the hacker to access the larger organization. The hacker then requests a large ransom amount that the larger company would be more likely to pay to keep their data secure and eliminate downtime.

3. Phishing Cyber Threats

Phishing attacks come in the form of an email or text message that poses as another organization. The purpose of phishing is to trick people into clicking on a link and entering a personal password or confidential information from your company such as bank account numbers.

If you are unaware of the potential security threat of phishing attacks on your operating system, your client’s business could be compromised too! These attacks can result in a breach of customers’ sensitive data, compromised accounts, financial fraud, and more that can cripple or destroy data at any warehouse or 3PL.

4. Old-School Computer Viruses

Many companies now have specific operating system security measures in place to protect sensitive information and networks from catching a virus, detecting a phishing security threat, or downloading malicious code. The risk of contracting a computer virus still exists and can enter through a stand-alone computer, laptop, or mobile phone simply by clicking on a corrupt link received through email, web redirection, or text.

5. Plug-in or Removable Media

The most popular form of plug-in or removable media is USBs. These can infect warehouse operations in a number of different ways, installing malware onto your computer or sending a virus through the company’s network causing destruction in its path! To help detect and protect against malicious software, Totem.tech suggests that IT administrators disable removable media autorun on all company systems.

Critical Infrastructure Susceptible to Cyber Threats

Many warehouses and distribution facilities have smart networked operating systems that combine operation technology (OT) and information technology (IT) only accessible with a company login or password. While the two used to be separate systems, the technologies have since come together, becoming cyber-physical systems. In the past, OT was not connected to external networks or digital technologies keeping it safe from outside hackers. It was IT most at risk for cyber-attacks.

With the introduction of machine automation and software-driven picking tools over the past decade, operational tech is run by software over a network which puts it at risk for common cybersecurity threats. Device examples include RFID scanners, robotic machinery, cell phones, manufacturing cells, and conveyor lines that may or may not require a password to enter the operating system.

OT: Safety Focus and IT: Confidentiality Focus

In OT, the physical systems are vital to the overall well-being and safety of those who work there. Cold storage rooms, automated packaging machines, conveyors, and other equipment all must maintain stable values such as temperature and speed while requiring meticulous system control. When a company’s management fails to maintain effective OT systems or ignores potential security threats, it can lead not only to financial losses but also to unsafe working conditions for employees.

IT includes the storage, retrieval, manipulation, and transmission of digital information, making data and confidentiality a top concern. Warehouses and 3PLs should take IT security very seriously. Strong IT security is crucial for warehouses and 3PLs in order to prevent data breaches and system vulnerabilities.

IT Faces More Cyber Threats Than OT

While the risks of an attack on OT systems may be higher, IT can be corrupted and manipulated more easily. Simply put, IT has many more touchpoints with outside influences that pose potential cybersecurity threats. Each infiltration could potentially become a gateway for malicious software or hackers looking to steal data from your warehouse or 3PL. These gateways make logical sense given their proximity to Internet connection points such as Wi-Fi routers.

It’s important to remember that the potential magnitude of an OT physical equipment breach tends to be greater if not protected than that of a cyber data breach. A good example is the power system grids that were attacked by ransomware most recently.

Cyber-Physical Systems Need Protecting from Cyber Crimes

These co-mingled systems have become increasingly critical in today’s world. The nature of these assets means that any incident can quickly lead to physical harm, destruction, or loss of people and property. It is important that your warehouse or 3PL has the right security solutions in place to manage any risk. Gartner analysts predict an increase in incidents due to a lack of support from organizations that don’t put enough effort into protecting their cyber-physical infrastructure.

“Due to their very nature, cyber-physical systems face security threats unlike those affecting enterprise IT systems,” states Katell Theilemann, a VP Analyst at Gartner. As he wrote in a 2020 article from Gartner, “They are typically used in operations or mission-critical environments where value is created for organizations, so attackers are increasingly targeting them.”

Cyber-physical threats are different than most IT cybersecurity threats, explained Thielemann. They are of “increasing concern because they could have a wide range of impacts, from mere annoyance to loss of life.”

According to Jeannette McMillian of the National Counterintelligence and Security Center, in an MHI Solutions article, “Risk assessments have also evolved to incorporate the impact of a cyberattack. The prevalence of such attacks can no longer be disregarded,” she said. “Just hoping that it doesn’t happen to your company isn’t a viable strategy.”

Make Security Awareness a High Priority for Your Company

• Back up your system data and store it off-site, rather physically or in the cloud. Should your company be the victim of a damaging cyber attack, your information can be restored with the latest backup files. The National Institute of Standards and Technology (NIST) has developed a useful publication to help you identify critical data backups needed and develop a data restoration policy for your company.
• To help thwart phishing, malware, viruses, and overall system exploitation situations, train your employees well. Not only should you develop company policies on all equipment, systems, and removable media that could be prone to attack, but ensure that staff members adhere to them.
• Require that all system passwords are strong and should be changed at least quarterly to help with security measures. Institute multi-factor authentication for extra security.
• Software updates should always be instituted in a timely manner on all devices used for the business, whether personal or company owned. Don’t forget about updating your warehouse management system (WMS) software regularly as well.
• Speak to your WMS software provider so that they can advise you on how to best secure your WMS from threats.
• One way to test your security system is to hire an ethical professional hacker. Also referred to as pen testers, hackers are paid to gain access and test the vulnerabilities of a company’s IT system to highlight where potential cyber risks exist.
• Don’t forget to follow up on the results, especially if a large cybersecurity hole exists to destroy or steal data. Believe it or not, many businesses push the findings aside, only to find themselves on the receiving end of a cyber-attack in the long run.

Common Cybersecurity Threats Take Many Forms; Be Protected

• To prevent security issues to your critical infrastructure, make sure your WMS software is easy to use. When employees are comfortable using your chosen WMS software, quick judgment errors occur less often.
• A WMS software system should be scalable. Continually test new process controls, which can unfortunately leave you susceptible to cybersecurity risks through any connected devices. Work with your provider to minimize any probable cyber risks your company may face during installation or upgrades.
• Multiple site usage, vendor upgrades, or outside company additions also can increase the risk of a software supply chain attack whether on purpose or accidentally. Work with your WMS provider to monitor the possibility of future cybercrimes and plug the holes.
• Don’t forget about how your warehouse or 3PL connects to various transportation networks for shipping. Supply chain management cybersecurity risks may exist within their networks and could be introduced to your connected devices while cybersecurity threats continue.

“Regardless of the vendor’s reputation, the product itself might have security gaps,” said Heinrich Smit, deputy chief information security officer at cybersecurity specialists Semperis, in a Raconteur article. “Independent code reviews and application vulnerability reports are very helpful,” he added, “because they evaluate a product both inside the code as well as in situ from a penetrability perspective.”

Can Your WMS Help Prevent a Cybersecurity Threat?

More than likely, your WMS software is cloud-based, relies on internet connectivity, or communicates with in-house operational technology that needs to be protected from a potential cyber crime. It’s important that you communicate with your provider about any prospective cybersecurity risks you may be concerned about with their programming.

Argos Software takes client security seriously and will work with your warehouse or 3PL to develop preventative security solutions to put in place to protect your operational systems from potential data breaches and shutdowns.

Argos updates ABECAS Insight software regularly so that it incorporates the latest and most supported versions of Microsoft’s Windows server, SQL Server, and browsers. Since hackers typically find holes in outdated software protection to install malware and ransomware, this helps reduce the ability for cyber criminals to gain access to your company’s sensitive information.

In addition, Argos offers a trustworthy portal capability for ABECAS Insight WMS and Enterprise customers so they can allow their customers to securely access the system and see their inventory in real-time. Customers can also easily create orders, check inventory balances, and run reports. Argos staff keeps track of the latest Microsoft and SQL patches and advises you on how these updates will affect your operations.

It is important to note that the system is extremely secure in that it only provides the customer with visibility into their own inventory, meanwhile making sure that they don’t access any information related to other customers (ie. Pepsi cannot see Coke’s data or customers or other information if they’re both using the same 3PL).

ABECAS Insight web portals are 100% turn-key, require little set-up, and provide real-time data. In fact, when a custom feature or enhancement is added to ABECAS Insight at the request of one customer, it is added to the core of our software and included in the next update for all customers. The same is true for custom enhancements your warehouse or 3PL may add. The result? “Living” software that adapts to evolving market needs.

According to Veridian, a software selection and project planning company, Cybersecurity must be a crucial part of your risk management plan and overarching strategy for your WMS implementation. Their advice: “Make sure your organization considers cybersecurity before, during, and after WMS implementation.”

Thank you for taking the time to learn more about common cybersecurity threats, cyber attacks, and how to protect your distribution facility from a future security threat. We invite you to visit our previous warehouse security posts for even more helpful information to detect problems and protect your business. In Parts 1 and 2, we addressed Theft and Physical Security.

For additional information on how ABECAS Insight operates or how Argos Software can help your business, please contact us today or request a demo.