Latest / Speaking of Supply Chain / The Cyber Threat No Supply Chain Can Ignore

Transcript

The Cyber Threat No Supply Chain Can Ignore · Speaking of Supply Chain

0:00
Speaker 1: The companies that you're selling to are going to want
0:01
Speaker 1: to see that whatever way you've been acted, AI is
0:03
Speaker 1: not going to put their data at risk. That's really
0:06
Speaker 1: important because nowadays data is almost as valuable, if not
0:10
Speaker 1: more valuable, than the actual products that we sell to people,
0:14
Speaker 1: and that has a lot of implications. And so how
0:17
Speaker 1: do you show improve to people that you are secure
0:20
Speaker 1: and that you're handling it securely.
0:21
Speaker 2: That's an interesting assertion that the data that we handle
0:24
Speaker 2: could be more valuable than the actual products that we're producing, shipping, transporting,
0:32
Speaker 2: and selling. I'm absolutely flum mixed by that. Hello, and
0:39
Speaker 2: welcome to Speaking of Supply Chain, where we explore trends,
0:42
Speaker 2: current events, and innovations impacting the logistics and supply chain industries.
0:46
Speaker 2: I'm your host, Ellen Wood. Today we'll dive into one
0:49
Speaker 2: of the most critical issues shaping modern supply chains, cybersecurity.
0:54
Speaker 2: With global logistics becoming more interconnected and digitally dependent, protecting
0:59
Speaker 2: data ups and infrastructure from cyber threats is no longer optional.
1:04
Speaker 2: It's mission critical. Joining us is the CEO of Secure
1:07
Speaker 2: Cloud Innovations, Caleb Mattingly, who's going to share his insights
1:11
Speaker 2: on evolving risks compliance pressures and strategies to build resilience
1:16
Speaker 2: in supply chain and logistics networks. Welcome Caleb.
1:20
Speaker 1: Yeah, thanks, Ellen. Really excited to be on the show today.
1:23
Speaker 2: I'm excited to get to our conversation because I don't
1:26
Speaker 2: know of anyone who hasn't experienced some sort of hiccup
1:30
Speaker 2: or disruption with cybersecurity. So I'm sure that there is
1:33
Speaker 2: going to be something for everyone in this conversation. But
1:36
Speaker 2: before we get started, let's get to know you a
1:38
Speaker 2: little bit better. So our ice breaker for today is
1:43
Speaker 2: what is the worst style or fashion trend you ever embraced.
1:49
Speaker 1: It's a good and fairly weighted question here, But in
1:55
Speaker 1: high school, actually I embraced the whole fancy for Friday
2:01
Speaker 1: trend that kind of was going around. I don't know
2:03
Speaker 1: where I saw, probably on like Instagram or something at
2:05
Speaker 1: the time, but ended up dressing suit just about every
2:09
Speaker 1: Friday of my junior and senior years.
2:13
Speaker 2: Oh my goodness. And how did that work out for
2:15
Speaker 2: your social standing in high school? Because high school can
2:18
Speaker 2: be a cruel place.
2:20
Speaker 1: Well, let's just say I didn't get any additional dates
2:23
Speaker 1: from doing that.
2:26
Speaker 2: Did anyone accuse you of like being part of the
2:28
Speaker 2: debate team or going on a job interview or anything
2:31
Speaker 2: like that.
2:32
Speaker 1: No, I went to a pretty country esque school, so
2:37
Speaker 1: there was no debate team, and all future farmers of
2:41
Speaker 1: America knew that I was not part of it.
2:43
Speaker 2: So yeah, gotcha. Well, you know, those jackets are very distinguishable,
2:48
Speaker 2: so like you would know if you saw the future
2:50
Speaker 2: farmers walking around in their jackets. It's not just regular
2:54
Speaker 2: formal where we have something similar. We do work where
2:57
Speaker 2: Wednesdays here at the office where most of the time
3:00
Speaker 2: we're pretty casual, but on Wednesdays we all get dressed
3:03
Speaker 2: up and it's just the most random thing in the
3:05
Speaker 2: middle of the week. I would say the worst fashion style. Now,
3:09
Speaker 2: I'm a child of the eighties, so I had like
3:12
Speaker 2: the crazy bangs in high school, the permed hair, all
3:16
Speaker 2: of those. I think though, the craziest one that I
3:22
Speaker 2: did was for a while I really enjoyed. I want
3:25
Speaker 2: to say it was in junior high. Junior high's a
3:27
Speaker 2: terrible time for kids. It's just the worst period of
3:30
Speaker 2: anyone's life. No one, I think has a great time
3:33
Speaker 2: in junior high. But I was trying some different fashions
3:36
Speaker 2: than and it was it was in the early nineties,
3:42
Speaker 2: and I want to say that dressing in men's clothes,
3:44
Speaker 2: like men's shirts and like a mini skirt and like
3:47
Speaker 2: that fashion. I really took to that one, and I
3:50
Speaker 2: don't know why it was. It was really bad. Oh goodness,
3:59
Speaker 2: you know what. I'm I'm lad that those days are over.
4:01
Speaker 2: I don't think anyone could pay me enough money to
4:03
Speaker 2: go back to junior high or high school and have
4:05
Speaker 2: to deal with other people judging you on your appearance
4:08
Speaker 2: like that. It's just it's crazy, crazy, crazy.
4:15
Speaker 1: That's true. Totally agree.
4:16
Speaker 2: So the crazy thing we're talking about today though, is cybersecurity,
4:21
Speaker 2: and it feels like not a day goes by when
4:23
Speaker 2: we don't hear of something else in the news, some
4:26
Speaker 2: other breach, some other data leak. And so, in your view,
4:33
Speaker 2: what are some of the biggest risks facing our industry
4:37
Speaker 2: so that the supply chain logistics, you know, what risks
4:41
Speaker 2: are we facing today and what's different from even something
4:45
Speaker 2: I can't believe COVID was five years ago, but even
4:48
Speaker 2: something since COVID that we've had to, you know, change
4:52
Speaker 2: and adapt the way that we approach cybersecurity.
4:56
Speaker 1: Yeah, a great question. You know, logistics is always seen
5:01
Speaker 1: as kind of a separate business entity than operations and
5:05
Speaker 1: other pieces of businesses, right, but functionally from a cybersecurity standpoint,
5:12
Speaker 1: there can be just as many risks in logistics as
5:15
Speaker 1: in any other part of the business. And I think
5:19
Speaker 1: one of the biggest overlooked pieces of that, especially by
5:24
Speaker 1: people that end up being in cybersecurity within like information
5:28
Speaker 1: technology as opposed to operational technology. And I can speak
5:32
Speaker 1: to the difference there, but is lack of connectivity. So
5:37
Speaker 1: I was actually just talking with a friend of mine.
5:39
Speaker 1: He's part of a full service solution for a logistics
5:42
Speaker 1: company or biologistics company, and what they ended up doing
5:47
Speaker 1: is they created a satellite based tracking system for shipments
5:52
Speaker 1: and specifically identifying when those cargo containers were opened or closed.
5:59
Speaker 1: So this was crazy because I had no idea about
6:02
Speaker 1: this until talking with him. But apparently people will wait
6:07
Speaker 1: until tractor trailers are out in the middle of like
6:10
Speaker 1: the desert, right, and then they will go and essentially
6:13
Speaker 1: like break into the tractor trailer that's on this highway
6:16
Speaker 1: when it loses connection with the internet or like with
6:21
Speaker 1: cellular service networks, and that steal whatever's in there. I
6:25
Speaker 1: think that happened with like a lot of PlayStations actually
6:28
Speaker 1: recently PlayStation fives and and so in doing so, like
6:33
Speaker 1: when they lose internet connection and they lose like cell service,
6:36
Speaker 1: the driver can't call for help, right, can't call law
6:39
Speaker 1: enforcement for help, and it creates a window of opportunity.
6:43
Speaker 1: And people think like cybersecurity is very focused on just
6:46
Speaker 1: like being on a computer and typing on a keyboard
6:48
Speaker 1: and somebody screaming on I'm here, you know, But like
6:51
Speaker 1: the reality is that it also deals with these situations
6:55
Speaker 1: that are in the physical world right where connectivity and
6:58
Speaker 1: interconnectivity is so important for securing a variety of things,
7:03
Speaker 1: and in this case it's transportation vehicles and what they
7:06
Speaker 1: are transporting. And so what I've I've found very interesting
7:11
Speaker 1: is a lot of companies haven't been thinking about that
7:14
Speaker 1: as much, and especially within the logistics space and specifically
7:17
Speaker 1: around stealing and that happens across the board, right, Like
7:22
Speaker 1: in it we call insider threat, right, you have like
7:25
Speaker 1: insider trading that occurs, or you have someone that goes
7:28
Speaker 1: in and maliciously makes changes to your application or your
7:31
Speaker 1: infrastructure and stuff. Well, in logistics it ends up being
7:35
Speaker 1: something very similar where you could have an insider threat
7:38
Speaker 1: of someone that is acting nefariously right or acting as
7:42
Speaker 1: a as a bad actor and not a bad actor
7:45
Speaker 1: like how Nicholas Cage gets his reputation stuff, but like
7:49
Speaker 1: a bad actors and someone is doing something that and
7:54
Speaker 1: they they go in and and and they find where
7:57
Speaker 1: is the whole like where is the point where uh
7:59
Speaker 1: they're there is no connectivity or where's the point where
8:02
Speaker 1: we can take something and no one finds out right?
8:05
Speaker 1: Or input change inputs in the in the database, right,
8:08
Speaker 1: so that instead of showing one hundred and one in
8:11
Speaker 1: this case PlayStation's there's only one hundred that are in
8:14
Speaker 1: the box, and so I get to steal this one
8:16
Speaker 1: and no one knows, right Like that that's a significant
8:19
Speaker 1: part of logistics and just retail in general, right of
8:24
Speaker 1: a bad data input or people acting and putting in
8:29
Speaker 1: false information.
8:30
Speaker 2: So well, and you mentioned something about the difference between
8:34
Speaker 2: information technology and operational technology. Do you want to expound
8:40
Speaker 2: on that a little bit?
8:41
Speaker 1: Yeah, So information technology typically deals with you know, your computers,
8:45
Speaker 1: your servers. It's the things that harness and have information,
8:49
Speaker 1: whereas operational technology is as you would probably imply, stuff
8:54
Speaker 1: that is being operated or like in the physical world,
8:57
Speaker 1: is in operation. So example of this is actually your
9:02
Speaker 1: HVAC system. So your HVAC system is an operational technology
9:06
Speaker 1: that crazy enough, could be hacked. And there's a ton
9:11
Speaker 1: of examples, and I think one of the most famous
9:13
Speaker 1: and kind of funniest examples, although it still has weight,
9:20
Speaker 1: is a casino that was hacked because someone broke into
9:23
Speaker 1: the fish tank monitor that was connected to the Internet
9:27
Speaker 1: and was able to steal millions of dollars through that spot.
9:33
Speaker 1: So yeah, that'll probably be the best example of an
9:37
Speaker 1: operational technology being taken advantage of.
9:41
Speaker 2: Well, and you know, we laugh because that sounds so
9:45
Speaker 2: absurd to use the fish tank monitor in order to
9:49
Speaker 2: enable the theft of millions of dollars. It sounds like
9:52
Speaker 2: some sort of you know, crazy story that would be
9:55
Speaker 2: the next Ocean's eleven. But you know, when you think
10:01
Speaker 2: about all of the different operational technologies that facilities have
10:06
Speaker 2: within their production, within their their warehousing and distribution networks,
10:11
Speaker 2: you know that's a significant amount of risk and you know,
10:16
Speaker 2: potential for an in if someone wanted to do something nefarious,
10:22
Speaker 2: if someone wanted to disrupt their business. So why do
10:26
Speaker 2: you think supply chain or logistics is of interest to
10:32
Speaker 2: any of these individuals. Are they doing it for that
10:35
Speaker 2: personal gain of you know, perhaps you know, stealing product,
10:40
Speaker 2: or are they doing it to try to disrupt individual businesses?
10:45
Speaker 2: What types of things do you see?
10:47
Speaker 1: Yeah, that's a good question, and I think it depends
10:49
Speaker 1: on the reason behind the attack, and I know that
10:52
Speaker 1: kind of is what your question is. However, as an example,
10:57
Speaker 1: right a couple of years ago, actually when when the
11:01
Speaker 1: whole political situation with Israel and Palestine started taking off,
11:06
Speaker 1: there's actually a brewer that was utilizing some brewing equipment
11:13
Speaker 1: that was Internet connected and was associated with an Israeli company,
11:19
Speaker 1: and the hackers actually attacked that that equipment turned off
11:22
Speaker 1: all the taps in the brewery because of that, and
11:25
Speaker 1: and then essentially when people logged in, they would see
11:28
Speaker 1: stuff that was very anti Israel on on the on
11:31
Speaker 1: the on the pieces that they're hacking into, and so
11:37
Speaker 1: very interesting because that was politically motivated, right to be
11:39
Speaker 1: able to say like, we just are anti this, and
11:42
Speaker 1: and that's that's that. Whereas you have other people that
11:45
Speaker 1: are bringing into things too potentially like steal company information.
11:51
Speaker 1: I mean, I'm sure that there are people out there
11:54
Speaker 1: that are trying to get you know, Coca Cola's secret
11:56
Speaker 1: ingredient or pepsizing, you know, see and everything, and those
12:02
Speaker 1: people are trying to do it for an entirely different
12:05
Speaker 1: reason than the group that was that was hacking this brewery, right,
12:09
Speaker 1: So it really depends on the attacking group or person
12:14
Speaker 1: uh in a lot of those cases. But with logistics
12:16
Speaker 1: in particular, I think one of the reasons why it
12:18
Speaker 1: ends up being such a big target for cyber security
12:24
Speaker 1: or cyber attackers is because of the fact that logistics
12:29
Speaker 1: is very often overlooked and your supply chain specific overlooked,
12:34
Speaker 1: and and more recently it's it's coming to light that like,
12:36
Speaker 1: we can't be doing that, but your supply chain also
12:40
Speaker 1: consists of all the vendors that are in that in
12:42
Speaker 1: that list, right, Like uh, Target actually a few several
12:45
Speaker 1: years ago had a huge hack that occurred, and it
12:49
Speaker 1: ended up being that one of the contractors that they
12:50
Speaker 1: were using actually was the one that brought the virus
12:54
Speaker 1: and brought brought like all of that exploit into their
12:58
Speaker 1: their network and their system. It wasn't a target employee.
13:01
Speaker 1: Target had like really good practices in place or decent
13:05
Speaker 1: practices in place. I guess if they were really good,
13:06
Speaker 1: it wouldn't have happened, right, But there was an oversight
13:10
Speaker 1: right on the full supply chain implications of we're using
13:14
Speaker 1: these vendors. They don't have to go through any kind
13:16
Speaker 1: of rigorous security process, so we just accept what they
13:21
Speaker 1: say that they're doing and that's that. And that ended
13:24
Speaker 1: up being kind of an advent for why we have
13:27
Speaker 1: so many frameworks now that that state requirements that you
13:31
Speaker 1: have to meet in order to do business with enterprises
13:34
Speaker 1: like Target or Walmart or you know, Fortune five hundred companies.
13:38
Speaker 2: That really leads into my next question endpoint, and that's
13:42
Speaker 2: you know, what are what are some of those regulations
13:44
Speaker 2: that are being enacted and what are some of those
13:49
Speaker 2: guide posts that are being set in order to say, okay,
13:52
Speaker 2: you need to be checking upstream and downstream with your
13:55
Speaker 2: suppliers and your vendors and understanding what their security measures are.
14:00
Speaker 2: Is anything changing from that legal perspective where there is
14:05
Speaker 2: at least maybe a shift in accountability.
14:11
Speaker 1: The International Standards Organization or ISO publishes a ton of
14:16
Speaker 1: different frameworks. We could say the most common that we
14:22
Speaker 1: deal with this twenty seven zero zero one, and that
14:24
Speaker 1: deals with information security management systems. But they have a
14:28
Speaker 1: ton and I'm sure that organizations that are out there
14:31
Speaker 1: that do consumer products and stuff are building consumer products
14:36
Speaker 1: deal with a lot of the QA, ISO, CERTI or standards,
14:40
Speaker 1: but there are several that actually pertain to using information
14:45
Speaker 1: security systems or information management systems and then also AI.
14:49
Speaker 1: So there's a new one that actually came out recently
14:52
Speaker 1: called ISO four two zero zero one, and that deals
14:55
Speaker 1: with your AI system, and that one's going to become
14:58
Speaker 1: a lot more prominent now because most people don't know
15:01
Speaker 1: how to secure AI. And I think from logistics companies
15:06
Speaker 1: and other companies involved in supply chain all the way
15:08
Speaker 1: to your traditional IT companies, everybody's kind of figuring out
15:14
Speaker 1: how do we utilize AI and our processes right to
15:16
Speaker 1: make things more efficient, to stop having so many bottlenecks
15:22
Speaker 1: in the process of creating either documentation or responses or
15:26
Speaker 1: whatever it is right or processing documentation UH. And so
15:31
Speaker 1: as we continue to move and progress in implementing AI
15:36
Speaker 1: across the business functions, I think that that specific standard
15:41
Speaker 1: is going to become more and more prominent across all
15:45
Speaker 1: of the different types of companies and sectors within business
15:50
Speaker 1: that we that we see on a day to day,
15:52
Speaker 1: especially in the supply chain, because your your vendors that
15:56
Speaker 1: you're the companies that you're selling to, right like as
15:58
Speaker 1: a as a vendor in logistic the companies that you're
16:02
Speaker 1: selling to are going to want to see that whatever
16:04
Speaker 1: way you've enacted AI is not going to put their
16:06
Speaker 1: data at risk, right And that that's really important because
16:10
Speaker 1: nowadays data is almost as valuable, if not more valuable
16:14
Speaker 1: than the actual products that we sell to people, and
16:18
Speaker 1: that has a lot of implications. And so how do
16:20
Speaker 1: you show and prove to people that you are secure
16:23
Speaker 1: and that you're handling it securely.
16:25
Speaker 2: That's an interesting assertion that the data that we handle
16:28
Speaker 2: could be more valuable than the actual products that we're producing, shipping,
16:37
Speaker 2: transporting and selling in stores. What I'm absolutely flum mixed
16:46
Speaker 2: by that. So what kind of data are they typically
16:49
Speaker 2: looking for in order to try to cause a disruption
16:54
Speaker 2: when you find those cases?
16:57
Speaker 1: I mean, it could it could really be a variety
16:59
Speaker 1: of things, and sure it could be anything military esque data,
17:05
Speaker 1: you know, like knowing that, hey, we don't know exactly
17:08
Speaker 1: where this plane is flying that holds this important person,
17:11
Speaker 1: but we do know that this airport was shut down
17:13
Speaker 1: for this period of time. We know that this airport
17:15
Speaker 1: was shut down for this period of time, and we
17:17
Speaker 1: know that a flight you know, came in and left
17:21
Speaker 1: for those two airports. Like that data can be crudal
17:23
Speaker 1: critical to someone in like a military perspective, but from
17:28
Speaker 1: from more of a commercial space or commercial side perspective,
17:32
Speaker 1: you know, like the data of how much your contracts
17:34
Speaker 1: are worth can be very important, right, Like someone knows
17:37
Speaker 1: how much you're bidding, that they can essentially underbid you,
17:41
Speaker 1: and that can be very heavy, heavy consequences if someone
17:47
Speaker 1: gets gets access to your financial data. But yeah, there's
17:52
Speaker 1: a lot of there's a lot of different types of
17:54
Speaker 1: data and and ways that they could correlate between different
17:57
Speaker 1: data points to draw conclusions that you know, maybe you
18:00
Speaker 1: don't have that directly in your spreadsheet, but by taking
18:04
Speaker 1: two different spreadsheets and analyzing them together and seeing the overlaps,
18:07
Speaker 1: you can draw necessary conclusions to get data that you
18:10
Speaker 1: wouldn't otherwise have.
18:12
Speaker 2: So yeah, I'm sorry I laughed at that when you
18:16
Speaker 2: said it, but my immediate thought was one of the
18:20
Speaker 2: end zcenes of a few good men where they're trying
18:23
Speaker 2: to prove that a flight took place and they have
18:25
Speaker 2: these log books and they can't prove it. It's a
18:27
Speaker 2: misdirection in the end. But you know, to that point,
18:31
Speaker 2: there's all kinds of information that we now have digitized
18:36
Speaker 2: that you know, we have even in the past, you know,
18:40
Speaker 2: fifty years, we haven't had this volume of data just
18:44
Speaker 2: available for someone to access. It's all been you know,
18:49
Speaker 2: much more siloed, much more protected, you know, when things
18:52
Speaker 2: are not connected to the internet, and now everything is
18:55
Speaker 2: connected to the Internet, and so therefore the data can
18:58
Speaker 2: be accessed if someone is diligent enough or tenacious enough
19:05
Speaker 2: to keep trying to find to find a way in.
19:08
Speaker 1: Well. I can also say something else that's very interesting
19:12
Speaker 1: about in twenty nineteen, I worked with an industrial control
19:15
Speaker 1: system cybersecurity company and we were looking for ways to
19:19
Speaker 1: try to get data like that, right, like how do
19:21
Speaker 1: you how do you how do how would an attacker
19:24
Speaker 1: come up with these things? Like you've got to kind
19:26
Speaker 1: of think like the attacker in order to you know,
19:28
Speaker 1: defend against this. And one of the things that we
19:31
Speaker 1: came up with is temperature fluctuations in a room when
19:34
Speaker 1: someone walks in, so like you actually get a slight
19:37
Speaker 1: temperature fluctuation when someone comes in or leaves a room, right,
19:43
Speaker 1: so like based on that you can actually identify how
19:45
Speaker 1: many people are in the room versus not in the
19:47
Speaker 1: room and things like that. It was very interesting. But
19:51
Speaker 1: there's a lot of implications when you start taking a
19:53
Speaker 1: ton of data points, right, and you aggregate them together
19:56
Speaker 1: and you can see where they overlap, like I was saying,
19:58
Speaker 1: and then you can draw conclusions that you wouldn't necessarily
20:01
Speaker 1: have had.
20:03
Speaker 2: So when there is a cyber breach and it affects
20:07
Speaker 2: something in the supply chain, whether it's a supplier or
20:10
Speaker 2: a vendor carrier, when it goes through the entire supply
20:17
Speaker 2: chain and affects those multiple organizations like you were mentioning
20:21
Speaker 2: with the target and it was just a contractor that
20:24
Speaker 2: they were using. What strategies help companies build the resilience
20:29
Speaker 2: against those types of disruptions. Is it just a matter
20:33
Speaker 2: of having more policies in place to say, hey, you know,
20:36
Speaker 2: you have to be able to demonstrate your security measures
20:39
Speaker 2: and at least you know, have everybody's teas dotted and
20:43
Speaker 2: I crossed so that you know everybody has their own
20:48
Speaker 2: scope of responsibility. Or is more interaction and more collaboration
20:55
Speaker 2: needed between individuals or companies or groups within those chains
21:00
Speaker 2: in order to make this a robust solution that's going
21:03
Speaker 2: to truly protect the data.
21:06
Speaker 1: I typically tell companies kind of tongue in cheek that
21:10
Speaker 1: a lot of the compliance frameworks end up being sort
21:13
Speaker 1: of like pyramid scheme in the sense that when you
21:17
Speaker 1: when you first take on like SoC two or ISO whatever,
21:21
Speaker 1: a lot of times the advice that's given, and it's
21:24
Speaker 1: not a mandated requirement, but it's pretty heavily advised, is
21:28
Speaker 1: to have all of your vendors then become compliant or
21:32
Speaker 1: only do business with vendors that are compliant with soft
21:34
Speaker 1: to or go and such. And while it is somewhat
21:38
Speaker 1: of a joke, uh and and and people typically laugh
21:43
Speaker 1: and stuff when when I bring that up, it's not
21:46
Speaker 1: a bad practice in and of itself because it sets
21:49
Speaker 1: a baseline for who you're doing business with and how
21:51
Speaker 1: they're handling data. And can they lie about it? Yes,
21:54
Speaker 1: anybody can lie about like what they're doing. And you know,
21:58
Speaker 1: from a business standpoint, you know vendors lie all the
22:01
Speaker 1: time and say like, hey, we do this thing, and
22:03
Speaker 1: then they don't write or it's on the roadmap and
22:05
Speaker 1: it's not on the roadmap. But the reality is that
22:07
Speaker 1: you need something that someone signs off on and says
22:10
Speaker 1: baseline wise, we have this in place, and this is good.
22:15
Speaker 1: What we have found in doing business with organizations is
22:22
Speaker 1: they need something. And on top of having this like
22:26
Speaker 1: framework in place, you have to have cybersecurity insurance nowadays.
22:30
Speaker 1: Like you have to. It doesn't matter what business you're in.
22:33
Speaker 1: It doesn't matter what kind of business you're in. Cybersecurity
22:35
Speaker 1: insurance is mandatory. If you have anything that touches the Internet,
22:39
Speaker 1: including a fish tank, you need cybersecurity insurance in order
22:44
Speaker 1: you do you do, I mean it's true, in order
22:46
Speaker 1: to do that, and a lot of people overlook that.
22:49
Speaker 1: You know, heck, a lot of businesses overlook general liability insurance,
22:53
Speaker 1: and please don't do that. If you're listening to this
22:55
Speaker 1: right now, please make sure the have general liability insurance,
22:58
Speaker 1: but also make sure that you cybersecurity insurance because that's
23:02
Speaker 1: that can make you break your business. You know, like that,
23:05
Speaker 1: it's so important. And I think also just a tidbit
23:11
Speaker 1: as like somebody that works with a lot of different
23:13
Speaker 1: types of companies and specifically companies that are sometimes outside
23:18
Speaker 1: the norm of who you would think needs cybersecurity. Make
23:22
Speaker 1: sure that you have back like, make sure you have
23:24
Speaker 1: backup a data data backups. When we were just talking
23:28
Speaker 1: right like about your data can be almost more important,
23:31
Speaker 1: potentially than even the products that you're pushing. Make sure
23:35
Speaker 1: the have backups of that data.
23:37
Speaker 2: So absolutely absolutely, So you were talking about certifications, we're
23:43
Speaker 2: talking about insurance. How do businesses make the business case
23:48
Speaker 2: for these investments in logistics and supply chain, which, as
23:52
Speaker 2: you've already said, is often overlooked. So what does it
23:56
Speaker 2: take in order to get these stakeholders aligned and bought
24:01
Speaker 2: in to the idea that this information or or you know,
24:06
Speaker 2: this aspect of their business is open to threat.
24:11
Speaker 1: Like, how do you make someone aware that they are
24:13
Speaker 1: exposed in some manner?
24:15
Speaker 2: Yeah? What what is it that helps change their mind?
24:19
Speaker 2: What is it that opens their eyes to understand what
24:23
Speaker 2: the risk is, what the what the mitigation is if
24:26
Speaker 2: a risk goes unprotected and there is a breach, you know,
24:32
Speaker 2: balancing those costs of yes, it's going to cost money
24:35
Speaker 2: to have cyber security insurance. Yes, it's going to cost
24:38
Speaker 2: money to go through the process of being certified in
24:42
Speaker 2: this or that or the you know the other standard.
24:45
Speaker 2: Why should they do that when they're looking at it
24:48
Speaker 2: and saying it's you know, it's just easier to write
24:51
Speaker 2: off that truckload of product. It's not that big a
24:54
Speaker 2: deal in the scheme of things. That's you know, a
24:57
Speaker 2: handful of product compared to their larger portfolio.
25:00
Speaker 1: That's a good question. And another good question. You've had
25:03
Speaker 1: a lot of good questions, Ellen, I think there's a
25:09
Speaker 1: couple of different questions actually embedded in that.
25:14
Speaker 2: Yeah, there was. That was a whole little monologue, is.
25:17
Speaker 1: The last one. First, I would not advocate for spending
25:23
Speaker 1: more money on a solution to deter a problem, like
25:32
Speaker 1: a risk, then the risk itself would incur if it
25:36
Speaker 1: is realized. So and in cybersecurity and anytime, like you're
25:43
Speaker 1: looking at risk, you need to do a cost analysis, right,
25:46
Speaker 1: like if this, if this risk is realized, what is
25:50
Speaker 1: what is the problem? And like if it's hey, once
25:52
Speaker 1: a year we lose a whole shipment's worth of whatever
25:56
Speaker 1: it is that we're pushing because of theft or because
25:59
Speaker 1: of something cybersecurity related. But then and that shipment is
26:03
Speaker 1: worth I don't know, let's just say two hundred thousand dollars, right,
26:08
Speaker 1: But if I'm going to pay insurance. It's going to
26:11
Speaker 1: cost me three hundred thousand dollars a year in order
26:14
Speaker 1: to have the insurance, then it doesn't make sense, right
26:17
Speaker 1: like that, that doesn't make sense to have. That's that's
26:21
Speaker 1: a very It's a tough way of looking at it,
26:26
Speaker 1: because you know, to an extent, you want to have insurance, right,
26:28
Speaker 1: you want to have like these these things in place,
26:31
Speaker 1: these deterrences, but at the same time, you don't want
26:33
Speaker 1: to spend more for them than if if you actually
26:36
Speaker 1: have the risk occur, so the attack occur, the problem occurs.
26:42
Speaker 1: So that that's I think that was the final question
26:46
Speaker 1: that you asked is how how do they you know,
26:47
Speaker 1: determine that And in regards to the rest of it,
26:52
Speaker 1: how do you get buy in right? Like, how do
26:53
Speaker 1: you get buy in on on this? Let's just say
26:55
Speaker 1: that it's you know, fifty thousand dollars for the insurance
26:58
Speaker 1: for the year. I have. I have no idea what
27:00
Speaker 1: anybody generally speaking cybersecurity insurance would.
27:03
Speaker 2: We It will truly depend on what their business does
27:07
Speaker 2: and how big the risks are. I mean, the insurance
27:09
Speaker 2: suggesters know how to you know, tweak their own numbers.
27:13
Speaker 1: I'm thrown out numbers that are way bigger than what
27:16
Speaker 1: we pay, and so it's like, but just for the
27:19
Speaker 1: sake of argument, you know, and let's just say it's
27:20
Speaker 1: fifty thousand, and for them to lose a shipment of
27:23
Speaker 1: worth of supplies or product in the year would be
27:28
Speaker 1: still about two hundred thousand dollars. Well, I think at
27:31
Speaker 1: that point it's pretty easy to get buy in because
27:34
Speaker 1: you have numbers there. I think generally speaking, businesses and
27:38
Speaker 1: business leaders are willing to put forth the effort and
27:42
Speaker 1: to show actually I would I would go so far
27:46
Speaker 1: as to say in logistics and in supply chain, it's
27:48
Speaker 1: a lot easier to get buy in than in most
27:50
Speaker 1: other organizations when you have a software product. When you
27:53
Speaker 1: have a software product and you're trying to pitch like, hey,
27:56
Speaker 1: we need to have this new security tool in place
27:59
Speaker 1: because X, Y and Z could happen, you're kind of
28:03
Speaker 1: guessing as to how much fallout is going to be there, right,
28:06
Speaker 1: how much like the monetary impact at risk being realized?
28:10
Speaker 1: Whereas in logistics and especially in more consumer goods types
28:14
Speaker 1: of industries, you have a direct like one hundred percent,
28:20
Speaker 1: we know how much this stuff was worth and how
28:22
Speaker 1: it was how much it was going to sell for.
28:24
Speaker 1: You're able to like watline, like, hey, this is how
28:27
Speaker 1: much a cost to make it. This is how much
28:28
Speaker 1: we were going to sell for. This is how much
28:30
Speaker 1: we would have made h and now we've lost all
28:33
Speaker 1: of that. And and here's here's the the way that
28:38
Speaker 1: we would fix the problem, right, and this is how
28:40
Speaker 1: much costs. This is how much this cost. And if
28:43
Speaker 1: it's higher or lower, you can make your decision based
28:45
Speaker 1: off of that. But going to someone and showing them like, hey,
28:49
Speaker 1: you know, if we get this compliance framework in place,
28:51
Speaker 1: target will do business with us. And that's an additional
28:53
Speaker 1: two million dollars a year that we get and to
28:55
Speaker 1: get it in place is going to cost us, I
28:58
Speaker 1: don't know, fifty grand or one hundred grand a year.
29:00
Speaker 1: It's obvious that someone's going to go forward with that, right,
29:02
Speaker 1: you know, spend one hundred grand in there, Yeah dollars.
29:04
Speaker 2: Right, yeah, that's a no brainer.
29:06
Speaker 1: Exactly exactly. And that's one of the best parts about
29:10
Speaker 1: working in logistics and supply chain is that you were
29:13
Speaker 1: able to show oftentimes, not every time, and I'm not
29:16
Speaker 1: going to make a broad sweeping, you know, generalization, but
29:19
Speaker 1: oftentimes you're able to show a direct business impact and
29:23
Speaker 1: direct monetary impact on the business for the risk itself
29:29
Speaker 1: and the term so and I know you.
29:32
Speaker 2: Were talking about AI earlier and which is a whole
29:36
Speaker 2: other topic in and of itself, but one thing that
29:40
Speaker 2: we tend to see a lot of happening in facilities
29:44
Speaker 2: now is greater automation. I was talking about it just
29:47
Speaker 2: a couple of weeks ago on the podcast with someone else,
29:49
Speaker 2: and we were talking about, you know, labor and how
29:52
Speaker 2: you know, robotics is taking over a lot of just
29:56
Speaker 2: function in a lot of these warehouses and a lot
29:59
Speaker 2: of the production facilities, just because labor is so hard
30:03
Speaker 2: to come by, their people who don't want these jobs.
30:05
Speaker 2: So we now have machines doing these and these machines
30:09
Speaker 2: are connected, They're connected to a computer that's telling them
30:12
Speaker 2: what to do, and that is yet another risk. So
30:15
Speaker 2: as companies are increasing automation, increasing their reliance on you know,
30:21
Speaker 2: computer run programs, whether it's a robot, whether it's you know,
30:25
Speaker 2: their WMS or their ERP system, you know, all of
30:28
Speaker 2: that data is being passed back and forth between multiple
30:33
Speaker 2: systems all throughout the hours of the day. What other
30:38
Speaker 2: threats should they be looking for in order to make
30:43
Speaker 2: that that threat assessment, that risk assessment, in order to
30:46
Speaker 2: you know, justify the cost or even understand what the
30:50
Speaker 2: risk is.
30:51
Speaker 1: In those cases where you have, you know, your business
30:54
Speaker 1: network which has all of your IT stuff on it,
30:57
Speaker 1: and then more operational network will call with all the
31:00
Speaker 1: OT on it, there needs to be very clear lines
31:05
Speaker 1: between the two. That's incredibly important. You know those robots,
31:10
Speaker 1: the computers that those are hooked up to, and and
31:13
Speaker 1: that whole network should not be able to directly talk
31:16
Speaker 1: to your business network with all the finances and all
31:18
Speaker 1: of that. That's never that's a no no, right.
31:24
Speaker 2: And then some silos are good, some.
31:27
Speaker 1: Are good, And in the defense world there's a lot
31:30
Speaker 1: of air gapping that happens, and I believe that that
31:32
Speaker 1: happens in some cases in like the manufacturing world as well,
31:38
Speaker 1: where you're completely siloed from the Internet and you have
31:41
Speaker 1: to essentially bring things from one place onto that network,
31:45
Speaker 1: like from one network to another network, right and and
31:50
Speaker 1: keeping completely logically separated. When you have either of those
31:55
Speaker 1: two cases, whatever touches your operational network needs to be
32:00
Speaker 1: following some kind of standard, and in that case it's
32:04
Speaker 1: typically around your contractors that you need to be very cautious, right,
32:09
Speaker 1: and you know, one of one of the things that
32:12
Speaker 1: is really interesting and I've I've thought about a lot
32:15
Speaker 1: lately is how tax law actually is somewhat unhelpful in cybersecurity,
32:23
Speaker 1: and specifically it's specifically specifically because so when you have
32:29
Speaker 1: a ten ninety nine contractor, you're not allowed to give
32:31
Speaker 1: them a computer. If you give, if you furnish any
32:35
Speaker 1: kind of equipment to them, then they become a W two. However,
32:40
Speaker 1: if you have contractors that are coming onto your network
32:44
Speaker 1: and then you have to essentially be okay with how
32:46
Speaker 1: their business runs, like their computers and their mobile device
32:50
Speaker 1: management and all of that. Whereas I think it would
32:52
Speaker 1: make a lot more sense if we were able to
32:54
Speaker 1: give computers, you know, to these people that are that
32:58
Speaker 1: are contractors that are coming from another another company and
33:02
Speaker 1: being like, hey, when you when you're working with our systems,
33:05
Speaker 1: you use our systems, right, and you use security standards.
33:10
Speaker 1: But I would be curious to see if that ever changes.
33:13
Speaker 1: I'd be interested in seeing if if we can make
33:17
Speaker 1: a business case for for that to be changed.
33:20
Speaker 2: That would be an interesting change to have cybersecurity change.
33:24
Speaker 2: Tax law.
33:26
Speaker 1: Yeah, I mean, I'm sure crazy your things have happened,
33:28
Speaker 1: but I don't know, Uh, I think I think we'll
33:31
Speaker 1: have to get your podcast Ellen in front of some
33:33
Speaker 1: some politicians or something in order to get.
33:37
Speaker 2: I don't know, I don't know that that sounds like
33:41
Speaker 2: a daunting uh prospect. So you just said there's some
33:45
Speaker 2: crazy situations. What is the craziest cybersecurity attack you've ever
33:51
Speaker 2: personally dealt with? Besides the fishbowl? I mean that was
33:57
Speaker 2: just the news.
33:58
Speaker 1: Well okay, so, so craziest cybersecurity attack we've ever dealt
34:02
Speaker 1: with is we had a company that was like an
34:04
Speaker 1: ed tech company and they essentially helped teach languages to kids,
34:10
Speaker 1: and someone previous to us coming on and working with them,
34:16
Speaker 1: had created a It was it was actually a little creepy,
34:20
Speaker 1: but they found out the CEO's husband's name and then
34:23
Speaker 1: made an account on the on the easy two instance,
34:26
Speaker 1: like the server itself under his name, and then started
34:30
Speaker 1: uh changing all of the different links to point to
34:35
Speaker 1: like Indonesian casinos and stuff like that. It was really
34:39
Speaker 1: it was really odd, very interesting, easy cleanup, so that
34:42
Speaker 1: was good. Lots of backups were taken and that's what
34:44
Speaker 1: I was saying, though, is like you really want backups, right,
34:47
Speaker 1: so then you know, like, okay, we can see when
34:50
Speaker 1: something changed and when when an attack occurred, and we
34:53
Speaker 1: can revert back before that. But but that was that
34:56
Speaker 1: was pretty odd, and it's it wasn't odd because of
34:59
Speaker 1: like the reader. It was odd because they went through
35:01
Speaker 1: such a rigorm role to find out personal information, right like,
35:05
Speaker 1: and then leveraging that in the attack. That it was
35:08
Speaker 1: a little creepy. But yeah, that was probably the craziest.
35:12
Speaker 2: Yeah, that sounds like it has a note of personal
35:15
Speaker 2: to it.
35:16
Speaker 1: Yeah, yeah, it did. It did feel that way a
35:19
Speaker 1: little bit. It was, yeah, odd. But favorite story it
35:22
Speaker 1: would definitely be Stucksnet, which I think still kind of
35:25
Speaker 1: applies here. And that was almost twenty years ago now,
35:29
Speaker 1: I think, but maybe fifteen. And essentially Iran had their
35:35
Speaker 1: you know, nuclear facilities that were processing uranium and everything,
35:40
Speaker 1: and someone decided to hack into that through a through
35:46
Speaker 1: a consultant, through a contracting company because they were leveraging
35:51
Speaker 1: portable drives so like the little the USB sticks. Yeah, yeah,
35:56
Speaker 1: so they were leveraging that, and so they hacked the
35:59
Speaker 1: contra company the contract and company had to drive. It
36:02
Speaker 1: was a super sophisticated attack. But they pulled the drive
36:05
Speaker 1: out and then like took it into this facility, plugged
36:07
Speaker 1: it in to do their work, and everything ended up
36:10
Speaker 1: being that drive installed a worm inside of the nuclear
36:14
Speaker 1: plant and then in that process degradated the fans or
36:21
Speaker 1: something along those lines. I'm blanking full full all the
36:26
Speaker 1: terminal details the story. Yeah, the details for the story,
36:28
Speaker 1: but essentially it ended up causing it to get to
36:31
Speaker 1: the point where it could reach critical mass and everything
36:34
Speaker 1: it was. It was wild, but that process and that
36:37
Speaker 1: story was crazy. And thinking about how cybersecurity and how
36:44
Speaker 1: the supply chain plays such a huge role in even
36:47
Speaker 1: our nation's infrastructure right like, because that stuff is happening
36:51
Speaker 1: out in the world right now, and it's like how
36:53
Speaker 1: do we how do we protect against that? And we
36:55
Speaker 1: have to be thinking about that in a consistent manner.
36:58
Speaker 2: So yeah, now, and I remember that story that you
37:02
Speaker 2: mentioned about Iran because where when at that time, I
37:06
Speaker 2: was working for HSBC bank, and I remember the memo
37:10
Speaker 2: that came out that said no unauthorized USB drives and
37:14
Speaker 2: you had to check your computer. Now this is when
37:16
Speaker 2: we still had desktops, so you had to check your
37:19
Speaker 2: computer and every possible port before you turned it on
37:22
Speaker 2: each morning. It was like a new policy that we
37:25
Speaker 2: had to do in order to check that someone wasn't,
37:28
Speaker 2: you know, plugging in a keystrokelogger or anything like that
37:32
Speaker 2: into your computer in order to get access. And I
37:35
Speaker 2: mean that was at the time. It was a huge deal.
37:38
Speaker 2: And you know, the idea that someone could just plug
37:41
Speaker 2: in this little stick and it would record every single
37:43
Speaker 2: keystroke you did for that day, and then they could then,
37:47
Speaker 2: to your point, you know, deconstruct it, figure out what
37:50
Speaker 2: you did when you logged into something, what that user
37:52
Speaker 2: name was, what the next string of characters that was
37:54
Speaker 2: your password, and then they had access to all of
37:57
Speaker 2: your information just because they plugged in a USB stick.
38:02
Speaker 2: And even to this day, there are a lot of
38:04
Speaker 2: clients when when I go to a trade show or
38:07
Speaker 2: anything like that and I have USB sticks that are branded,
38:10
Speaker 2: you know, here's a nice memory stick for you. Oh sorry,
38:13
Speaker 2: our company doesn't allow us to use you know, promotional
38:17
Speaker 2: sticks that we get from some unauthorized, unknown individual. And
38:23
Speaker 2: I mean that's twenty years old and still a practice
38:27
Speaker 2: to this day in a lot of different organizations, and
38:30
Speaker 2: not without president clearly.
38:32
Speaker 1: Yeah, I mean there's this whole social engineering attack that
38:34
Speaker 1: you can do. Especially like the good guys come up
38:37
Speaker 1: with cool ideas and then publish them. You know, who
38:40
Speaker 1: knows what all the bad guys are trying and stuff,
38:42
Speaker 1: but the good guys will publish this stuff. And one
38:45
Speaker 1: of one of my favorites that I read about is
38:47
Speaker 1: you put a bunch of of essentially malware onto these sticks, right,
38:54
Speaker 1: and then you go out into the parking lot of
38:56
Speaker 1: the business that you want to work in, and you
38:58
Speaker 1: just drop a couple on the ground. Yeah, and then
39:01
Speaker 1: people take them and they take them home where they
39:03
Speaker 1: take them in the office and they go, I wonder
39:04
Speaker 1: what's all this, you know, and they plug it in
39:07
Speaker 1: and then bam, you got you got access, you know,
39:09
Speaker 1: like it's it's it's wild. But also I personally love
39:15
Speaker 1: learning about this stuff because it's amazing to think of
39:17
Speaker 1: like how creative these people are right coming up with this,
39:21
Speaker 1: and then how creative we have to be as defenders
39:23
Speaker 1: to try to fight against it.
39:26
Speaker 2: Exactly if only we could harness that that negative creativity
39:29
Speaker 2: for a more positive use. Well, thank you so much
39:35
Speaker 2: Caleb for sharing your perspective with our audience today.
39:39
Speaker 1: Yeah, of course, it was. It was awesome being on
39:41
Speaker 1: the on the podcast with the Allen, your great host.
39:44
Speaker 2: Thank you. As we heard today, cybersecurity is no longer
39:47
Speaker 2: just a technical safeguard. It's foundational to supply chain resilience
39:52
Speaker 2: and business continuity. Companies that recognize this will be the
39:56
Speaker 2: ones position to lead in the years ahead. To our listeners,
39:59
Speaker 2: if you found today episode valuable, be sure to like
40:02
Speaker 2: and follow Speaking in Supply Chain wherever you get your
40:04
Speaker 2: podcasts Spotify, Apple Music, Amazon Music, or iHeartRadio, and be
40:09
Speaker 2: sure to tune in next time.