The COVID-19 pandemic has highlighted the vulnerabilities of numerous sectors, including that of the logistics sector. Due to movement restrictions, many shipments, especially in the early days, were disrupted, wreaking havoc on supply chains.
According to Mike Karbassi (pictured), head of cyber underwriting at Corvus,as logistics have become more efficient to meet the demands of the economy, the sector has also become more inflexible.
“Many companies depend on having an exact number of items delivered at an exact time in order to continue normal operations,” Karbassi told Corporate Risk and Insurance.“The pandemic is forcing many companies to reconsider how their supply chains are set up, and logistics companies will need to adapt to the needs of their clients.”
One of the major risks facing logistics companies today is cyber, particularly ransomware attacks. This is exacerbated by increased digitalization, which is, in turn, being further driven by the need to adapt to the pandemic.
“A notable example is Toll Group, a logistics company, which was hit with not one, but two separate ransomware attacks in 2020,” Karbassi said.“But logistics companies must consider the impact of an attack on their clients or suppliers of their clients as well. For instance, the ransomware attack that brought down Norsk Hydro in 2017 led to global supply chain ripple effects because manufacturers rely on the aluminium products that company supplies. In this case, logistics companies would have to adapt and respond to unexpected disruptions despite not being directly attacked.”
Karbassi stressed the importance of logistics companies dealing with cyber risks by focusing on risk assessment, prevention, detection and response. Typical vectors used in ransomware attacks include exploiting software vulnerabilities, and entering via open or poorly secured ports and phishing emails.
“At Corvus, we help our clients in this regard by running regular, external scans of the company for vulnerabilities and open ports, and providing recommendations for how to harden their systems against attack,” he said. “When it comes to phishing attacks, investing in secure email gateway solutions and enabling multi-factor authentication to access email will greatly reduce the number of phishing emails that make it through to end users and lessen the impact if a user gives up their username and password.”
However, he added that even the best phishing solutions will still miss some malicious emails, so companies must conduct regular employee security awareness training. A good endpoint detection and response (EDR) solution or managed detection and response (MDR) solution are also worthwhile investments in preventing or mitigating the effects of a ransomware attack.
Lastly, logistics firms must take the time to create or review an incident response plan and a business continuity plan. This will allow them to be clear on roles, responsibilities and response procedures in worst-case scenarios.
“We've seen that COVID-19 has thrown digitalization and the adoption of technologies like sensors and scanners into hyperdrive,” Karbassi said. “It is a lot easier to be nimble and respond to a global event like a pandemic when more of your critical communication, tracking and back-end processes are digitized with modern systems. Look for logistics companies to continue their efforts to use technology to build more resilience and flexibility into their supply chains without losing efficiency. But of course, with increased reliance on digital tools, the risk of cyber incidents will not be going down, and some will become victims.”
