Cyber Attack Strikes US Critical Infrastructure

The US Agriculture industry is only the latest victim of ransomware attacks – highlighting yet again the susceptibility of our supply chain to devastating cyber attacks. Considering recent cyber attacks on the water supply, we need to rethink our conception of which industries and types of companies are at risk.

Information technology has become a critical component of every aspect of the American economy, and this change has made cyber risk universal.  Many industries think that their risks are low as they don’t believe day-to-day operations rely on computerized systems, but as the attack on JBS meatpacking plants demonstrated, this greatly contributes to a false sense of security and a growing risk climate for companies that form the backbone of the nation.

How much will this ransomware attack cost? The ransomware price tag alone is $5.9 million, but the true cost will likely be much higher. New Cooperative supplies feed to chicken producers, and despite the reasonable move of shutting down operations to recover from the attack, those chickens still need to eat. The $5.9 million ransom demanded by the fledgling ransomware group, BlackMatter, is also just the beginning as secondary impacts of the attach spread from New Cooperative throughout the US food delivery system.  In typical fashion, the cost of systems recovery is more than the actual ransom. Even leaving out the impact on third parties beyond the known $5.9M cost, there will also be significantly larger costs of recovery, including the cost of lost business, damage assessment, shutdowns, reputational damage, remediation, legal fees, and regulatory penalties.

But there are also reasons to be optimistic. Based on the publicly available data on this attack, basic mitigation strategies would have helped prevent it from occurring in the first place.  Robust Identity and Access Management (IAM) with multi-factor authentication, routine monitoring of breached credential databases, and comprehensive Privilege Access Management for key systems are tools that are readily available, and a relatively modest investment in these technologies can lead to a significant reduction of the corporate attack for groups like BlackMatter.

What is Ransomware?

A ransomware attack is a type of data breach where hackers obtain access to digital information and then hold it “hostage” for a negotiated sum. Like the attack on New Cooperative, the effectiveness of this extortion lies in its ability to disrupt an entire infrastructure. Ransomware is now a multi-billion-dollar industry that is increasingly dangerous. It’s estimated that ransomware attacks cost the US economy approximately $20B/year. IBM reports that the average cost of a ransomware attack in 2020 was $4.44M, and Cybersecurity Ventures has estimated that, in 2021, a business will fall victim to ransomware every 11 seconds.

The actual cost of a ransomware attack carries other hidden costs beyond the negotiated price tag. In most cases, it’s impossible to know the breadth of data to which the hackers gained access. Not only can the hackers encrypt the stolen data and hold it for ransom, but nothing is preventing them from saving and selling that data or holding it for ransom again later.

Many ransomware attacks demand numbers that seemingly make sense for a company to simply pay.  Acer recently made news with the highest ever ransom demand of $50 million, but against an annual revenue exceeding $2.5 billion, a $50 Million ransomware is not an amount that would cripple the company’s bottom line.  New Cooperative is being extorted for $5.9 million but that sum needs to be balanced against annual sales over $1 billion.  However, it is not ideal to pay hackers the ransom they demand. After all, it sets a precedent with the hackers (and continues to fuel their illicit criminal activities) and may even be considered illegal in the U.S. depending on circumstances. Many ransomware attacks also go unreported, leaving security experts with limited data to make estimates or decisions around mitigation.

The 2021 Surge in Ransomware Attacks

While much of 2021 has been focused on figuring out how businesses and their workers can emerge from the coronavirus pandemic, it’s also true that cyberattack security is playing a big role in organizations’ day to day concerns. After all, the right cyber security risk management provider can help avoid those ransomware attacks that can drag a business down for days, weeks or months, as we’ve seen with various security breaches this year, and anyone that wants to ensure uptime and stability in their department and organization would do well to adequately protect themselves against the growing world of cyber threats.

To many security researchers, a pandemic of security is front of mind today, and that means working with a competent cyber risk management software company. In fact, ransomware attacks have increased significantly in 2021, to the point where significant sectors of the American economy have been affected — from healthcare to water treatment and gas availability. The reason that hacks are increasing in volume is that more people than ever are working remotely, and many companies unfortunately don’t have the right protocols in place to prevent unauthorized access. The Biden administration has even made cyberattack security a national security priority, but that doesn’t mean there still aren’t vulnerabilities out there.

Who’s at Risk?

When it comes to cyberattack security, not every sector or organization is seen the same. Businesses in certain sectors or that have a certain profile are often targets, but it also has to do with existing security competencies. It all started in February when hackers targeted a water treatment plant in Florida, increasing the levels of lye in community drinking water to dangerous concentrations for a brief time. In March, one of the largest insurance companies in the U.S. was hacked, leading to an inability to access their network for about two weeks. In April, the Houston Rockets NBA team was hacked with about 500 gigs of data stolen, which included contract information and other non-disclosure agreements.

In May, another cyberattack illustrated lax security at Colonial Pipeline, a company that was forced to shut off their gas supply to almost the entire East Coast. Also in May, a hospital system in San Diego lost access to their databases for about two weeks after a cyberattack. Security was also an issue in June when JBS, a large beef producer, lost control of their operations for two days. By July, a large IT firm was also hacked, leading to victims in 17 countries. And in August, Howard University had to cancel classes after a recent hack.

Is this the new normal?

Ransomware attacks have become increasingly common over the last few years, as they require relatively little technical expertise to carry out, and the victims can be easily extorted to make a profit for the attackers.  The spread of cryptocurrencies has provided a means for the attackers to demand money without leaving a trail for police to follow. With a low level of effort invested in each attack, only a small percentage needs to succeed to provide significant income to a criminal syndicate.  High-profile ransomware attacks like the ones on Colonial Pipeline, CD Projekt Red, Acer, and the District of Colombia Police Department, further demonstrate the need for organizations to assess their susceptibility to ransomware before it’s too late.

This industry may have been lulled into a false sense of security as manufacturing, healthcare, and financial services have traditionally been main targets for ransomware. However, the vulnerabilities we’ve seen exposed in the US Agriculture industry highlight that the supply chain industry is not immune (nor is any other industry) to these attacks. In addition to the financial cost, these attacks risk critical pieces of our interconnected infrastructure.

While the US government scrambles to implement new cyber security maturity standards and provide tools to enable businesses to manage cyber risk, hackers are not slowing down. CEOs cannot rely on the US government to stop cyber-attacks of this nature. Every company is vulnerable, and thus, every company must continue to improve its cyber programs. They also need to look at their third-party vendors, suppliers, and customers (among many other dimensions) to gain a more holistic view of organizational risk.  No company is an island, and an attack that shuts down a critical supplier or prevents a customer from accepting delivery can have as much of an impact on a business as a direct attack on their own networks.

Cyber Security is a Business Problem.

When considering cyber risk at the corporate level, there are a plethora of vulnerabilities, and the threat of ransomware looms large. With the seemingly exponential increase of attacks, the question is not “Will my company experience a ransomware attack?” but rather “When will my company experience a ransomware attack?” The sad reality is that CEOs in the Food Industry may not have the luxury of access to the most sophisticated security practitioners on their staff. Oftentimes they may not have a team at all but instead, rely on MSP/MSSPs for maintenance and configuration. With limited resources and/or budget, a wise approach is to identify and prioritize your business assets that need the greatest protection.

How Can I Prepare for Ransomware?

There are many easy ways for companies of all sizes to prepare for a ransomware event. First, as recent attacks make clear, ensuring appropriate cyber hygiene is a crucial first step in preparing for ransomware. Are all of your servers patched with the latest OS updates? Have you implemented SSO with robust MFA? Are you conducting routine security awareness training? Are you safeguarding privileged credentials and monitoring privileged user access to critical systems?

Companies should also routinely assess their cyber programs against industry-validated security assessment standards. The National Institute on Standards in Technology (NIST) provides a good basic framework for most businesses to look at their cyber risk profile and identify key gaps to address.  Routine assessments are valuable tools in understanding where a company stands and should be performed not just to meet compliance requirements but as a basic part of any risk management strategy.  An assessment at New Collective might have identified the weak passwords and lack of endpoint defense that appear to have allowed this attack to happen.  A more comprehensive assessment at JBS might have determined that there were control systems used by managers which were available on the public internet.

In the modern economy, no company simply can or should rely on its employees to practice good security measures. Business AND Security leaders must get back to cybersecurity basics.  And assessments provide the tools to ensure that when hackers go after low hanging fruit, your company is not the one they find.