When we buy groceries at the supermarket, most of us check the ingredients and expiration dates of packaged goods.
But how can we be sure that the products we bring home are safe to eat and drink?
Naturally, food and beverage (F&B) manufacturers have a vested interest in ensuring the quality and safety of their products.
The impact of a tainted product reaching the market can be devastating, both in terms of public health and brand reputation. In fact, recent FDA rules require companies to implement mitigation strategies aimed at protecting food against intentional adulteration.
Food safety can be compromised by various sources, from disgruntled employees to politically-motivated sabotage and even acts of terrorism. Cyber threats aimed at F&B companies' ICS networks also pose a risk to manufacturing processes and can lead to a wide range of food safety and operational issues. Unfortunately, most F&B companies' cyber security strategies overlook the risks to their industrial control processes.
F&B Manufacturing & Cyber THreats: What's at STake?
Cyber security goes beyond IT security and segmentation of industrial networks – it must also protect the Industrial Control Systems (ICS) that are at the heart of the F&B manufacturing processes. These systems control production quality and recipe execution, like the mix of ingredients and temperatures at which the food is processed and stored prior to shipping.
Any unauthorized change to an ICS controller – due to a sophisticated cyber attack or an innocent human error - can result in the production of tainted and unhealthy products, and the price of such an error can be exorbitant.
Throwing out a production batch due to incorrect ingredient ratios, altered sugar levels or milk temperature, for example, can cost F&B companies millions of dollars. Imagine the implications of a wrong ingredient finding its way into a breakfast cereal that causes an allergic reaction in children. As a result, food safety dictates zero tolerance for unintended changes to manufacturing processes.
In the event of a safety issue, F&B companies have no choice but to shut down the relevant production line until the problem is sorted out.
For a global F&B manufacturer in the UK that subsequently became an Indegy customer, the cost of shutting down a single production line in terms of lost revenues was approximately £48,000 per hour, or more than £1 million per day. As F&B manufacturers typically operate 24x7 and operate multiple production lines, downtime costs due to an ICS-related cyber incident can be astronomical.
Automation Technologies Are a Double-Edged Sword
ICS networks are more vulnerable to cyber attacks than their IT counterparts. This is due in large part to the fact that most ICS networks were designed decades ago, well before cyber security became a concern. Thus, while ICS network face the same cyber risks common in IT environments, they suffer from an absence of basic security controls and the lack of automated asset management capabilities.
Ready to learn how automated asset management can improve industrial security?
This vulnerability has been exacerbated in the F&B industry by manufacturers' increasing reliance on automated industrial control systems to process, store, and manage large product volumes. In recent years, new connected technologies such as IIoT (Industrial IoT) devices have been introduced into these systems to improve supply chain analytics and enable predictive maintenance.
While automation and connectivity increase productivity and allow companies to focus more on innovation, these technologies also create new security challenges, expose unprotected ICS systems and heighten cyber risks.
The inherent risks of ICS networks to cyber attacks can be attributed to the following factors:
- OT networks were not designed with security in mind, meaning that industrial controllers are not typically protected with authentication, encryption, authorization, or other standard security mechanisms.
- A successful cyber attack on an OT network could have product quality and safety implications as well as financial, legal and environmental ramifications.
- It is much more difficult to monitor OT networks than it is to monitor IT networks because of the lack of monitoring tools, the proprietary protocols in use, and network isolation.
In addition, the fact that control systems within a food manufacturing facility are often networked into other company IT systems (e.g., administrative, financial, ERP) increases their exposure to a cyber attack. As such, a single breach to any IT or OT device puts the entire ICS network at risk.
Internal and External Security Threats to F&B Operations
Low-security ICS networks are low-hanging fruit for traditional hackers, cyber criminals for hire, or even nation-states. However, while external cyber attacks that steal data grab headlines, most manufacturers believe that the main threat comes from insiders.
Within this category, the leading cause of operational downtime is human error, followed by malicious insiders who can also tamper with these systems.
Innocent mistakes and negligence on the part of trusted employees, contractors and integrators, such as making changes to the wrong PLC, or incomplete maintenance to DCS systems, can trigger a variety of disruptions, downtime and tainted food products.
Cyber Risk Awareness Is the First Step to Prevention
Until now, most F&B manufacturers have shown little awareness regarding the risks to food safety and manufacturing processes from cyber attacks. This is partly due to the minimal levels of reporting of actual cyber events within the industry.
Reinforcing the perception of low risk is that the FDA does not see cyber systems as a component of food safety risk. Certainly, the FDA supports private sector’s need to secure technological systems from attack, but they do not specifically include these systems in their FSMA rules or guidance.
However, the truth is that cyber attacks represent a serious risk for F&B companies. They can disrupt manufacturing processes, take down a production line and result in tainted and unhealthy products reaching the public. The financial impact of such an incident can easily run into millions of dollars.
To protect themselves from cyber threats, F&B companies must ensure that their industrial control systems environments are protected from unauthorized intervention and that all changes to production devices are tracked and monitored.