How important is cybersecurity in logistics?
In terms of cybersecurity, we highlight the availability of logistics systems as the basis and fundamental pillar of operations. Logistics ‘lives’ in real time (orders, warehouses, routes). An incident can halt receptions, preparation, dispatches, shipments, etc., which has a direct impact on our end customer.
A loss of service can mainly have the following consequences:
- Direct economic impact. Service stoppages, penalties for SLA breaches, express transport surcharges, staff overtime and loss of stock and sales.
- Trust and reputation. Our customers (both B2C and B2B) demand traceability and reliability. A single incident can lead to the loss of contracts.
- Compliance and obligations. There are directives and regulations that increase requirements and reporting. It is necessary to comply with current regulations.
What about privacy?
In the field of logistics, a lot of personal information is processed. On the one hand, there is customer information: name, address, telephone number, delivery instructions, incidents. On the other hand, information about technicians, delivery personnel and employees: geolocation, shifts, performance, routes, proof of delivery (photo/signature).
It is important to be clear about and implement the correct processing of such sensitive data. Based on current regulations (in particular, the GDPR), the following must be ensured:
- Minimisation (collecting only what is strictly necessary).
- Purpose limitation (do not reuse data for another process).
- Retention (deletion or obfuscation of data with deadlines).
- Transparency (report all processing).
- Security (technical and organisational measures).
What are the main risks in these areas for the logistics sector?
The main risks in the logistics sector are as follows:
- Ransomware and extortion. There are threats of operational shutdowns and data theft.
- Data leaks. Exfiltration of customers, rates, routes, contracts, warehouse plans, credentials, etc.
- Account compromise. Whether using simple or advanced techniques, changes to supplier bank accounts, invoice fraud and fake urgent orders can occur.
- IoT devices. As technology advances, new devices are introduced that have new vulnerabilities. In addition, some devices are very difficult to patch.
- Denial-of-service (DDoS) attacks. An attacker (or group of attackers) can make massive requests to different components of the systems, which can cause portals to crash or shipment tracking to fail.
What solutions and strategies are most effective against these threats?
In the area of governance and risk management, we must always apply an inventory of critical assets and processes. In addition, a risk model must be included for each process (warehouse, transport, customer service, billing, etc.), always following the corresponding legal framework: NIST CFS 2.0 (Cybersecurity Framework), ISMS / ISO 27001.
At a technical level, the relevant security measures must be implemented. Starting with the authentication of portals with MFA (multi-factor authentication), applying a correct network segmentation strategy with minimum access, implementing risk detection systems and processing the data collected in information and security event management (SIEM) tools. It is also important to have redundancy in the different systems and/or servers, as well as to make backups for restoration if necessary.
How have cybersecurity and privacy evolved in the logistics sector in recent years?
In recent years, as technology advances, many more processes are being digitised. This increases the range and surface area of attack: APIs, cloud, integrations, real-time data, IoT… This inevitably leads to an increase in relevant incidents in transport and logistics.
Pressure is coming not only from the increase in threats, but also from EU regulatory pressure. There is greater oversight as a result of the NIS2 regulatory framework, which has undergone changes in recent years, such as extensions of scope, management responsibilities, and reporting and risk management obligations.
Audits are clearly necessary, especially with the type of data handled in the logistics sector. However, privacy and data protection are not just a matter for the legal department, but are fully integrated into the design and operation of day-to-day processes and technology.
It affects phases such as tracking (shipment tracking), delivery (usually including name/signature, photo, time, location), analytics and information exploitation (dashboards, KPIs, AI/optimisation), video surveillance in warehouses and locations, and many other points in the chain that are duly adapted to the necessary policies.
What impact has the evolution of new technologies had on cybersecurity and privacy in this sector?
The following technologies have increased the risk:
- IoT / telematics / RFID / sensors. There has been a proliferation in the number of endpoints, which often have complex patching, sometimes weak credentials, and are highly dependent on technology providers.
- OT and automation (robots, conveyor belts, PLCs). These devices prioritise availability and physical security and require specific segmentation and monitoring.
- Cloud, APIs and microservices. They increase the surface area exposed by misconfigurations, poor key/secret management and excessive permissions.
- Mobility (PDA/RF). There is a risk of terminal loss or theft.
- AI and automation. Possible data leaks or injection attacks if tools are used without control. In addition, attackers can also use AI to launch their attacks.
However, there are technologies that have improved defence:
- Zero Trust / SASE. This is identity- and context-based access, ensuring minimum privilege (especially useful with multiple warehouses and third parties).
- EDR + SOAR. Thanks to tools of this type and their evolution, we have better detection and response on endpoints and servers, with greater automation of containment.
- Observability and traceability. Centralisation of logs and event correlation to speed up investigation and response.
- Privacy and compliance in products. The EU is promoting horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), which is relevant due to the growth of devices connected to the logistics chain.
