Protecting livestock farms from cybercrime pt. 1

Part 1: Cyberthreats are real

The reality of cybercrime for livestock farms is almost too easy. Most farms have internet access, which means they are tied to international supply chains, making them vulnerable.

Andrew Rose, of the nonprofit Bioeconomy Information Sharing & Analysis Center (BIO-ISAC), discussed critical and timely questions about farm cybersecurity during a Balchem presentation. Rose brings cybersecurity experience and related threat awareness, mitigation and response with a focus on agriculture and food.

What Rose discovered over the past 10 years is that agriculture is still in the “awareness” stage – becoming aware of what’s out there and what they intend to do. He now focuses on future threat modeling to determine what the next attack could be, who the adversary could be, what weapons they’ll use and the secondary effects if this happens.

“If we see a concentration of things happening in a certain country or sector, we know adversaries will use this to experiment – test cyberwarriors and weapons prior to deploying on us,” said Rose. “In dairy, we saw some very interesting attacks. We poked and prodded as far as we could ethically and legally and saw a lot of vulnerabilities.”

Dairy farmers are familiar with animal activist groups and their goal: to eliminate animal protein from the plate. But as these groups become savvier and more active, it’s important to be aware of new and emerging threats.

The activist group Counterglow organized Project Counterglow. This crowdsourced website lists numerous animal production and processing facilities throughout the U.S. Rose referred to their database as “staggering.” There are rumors of blackout drones flying around, looking at entrances and tracking vehicle movements. The organization is useful for “lone wolf” activists looking for targets and provides a resource for them to plot and plan.

“Direct Action Everywhere (DxE) is one of the most active groups,” said Rose. “Regardless of animal welfare and other issues they raise, their goal is to remove animal protein from everyone’s plate. DxE has been hosting the ‘right to rescue’ workshop, teaching people how to infiltrate animal production facilities and ‘rescue’ animals. PETA has been training people how to be a ‘spy’ and how to take advantage of the labor shortage to get hired and infiltrate into facilities, place cameras and create different types of chaos that look good on film.”

The web of those who provide monetary support to such groups shows they aren’t always directly financed. Instead, they use indirect financing with proxies to move resources to certain activist groups.

A concerning aspect of cybercrime is insider threats. In some cases, farm employees can be enticed, sometimes unknowingly, to conduct some kind of operation against the farm enterprise. A disgruntled employee is the one most likely to do this. Socially engineered attacks usually focus on low- and mid-level employees to gain credentialed access into operations. The first and most important step to mitigate such an issue is treating employees well so they are less likely to turn against the operation.

What happens to a robotic milking system if the manufacturer or vendor is hacked and takes down the equipment on your farm? Who is liable? Rose suggested asking basic questions of vendors including “If this plugs into the internet, what’s the password, and if so, can I change the password? Who can access the information? How long are data kept?”

“The supplier should be able to answer these questions; if not, they should strive to find solutions. It should be common to question anything that connects to the internet because it opens more doors for malcontents.”

Social engineering isn’t always intended to influence humans – it’s to gather information about the organization, such as workflow, who’s in charge of receiving or billing and the vendors and suppliers the company uses. Who answers the phone and what does their voice sound like?

“It isn’t humans doing it, it’s AI agents, or bots, doing this work, even though we’re in the early days of AI,” said Rose. “The ability to distinguish AI and your boss telling you to change the bank routing number is going to be very difficult. Law enforcement has let us know that fake invoices are very hot right now. This goes back to ‘Spidey sense’ – let your payable/billable people know this is something of high concern and everything should be treated with skepticism.”

The China-based cyberthreat “Salt Typhoon” is an advanced persistent threat group carrying out cyberattacks. Instead of embedding code deeply into your phone, the code sits in the phone’s temporary memory. Until the phone is restarted, the malicious code remains present and continues to operate.

“Tabletop exercises are a great way to build teamwork and build muscle memory,” said Rose, adding that this exercise includes having a strong SOP and backup plans. “In the event the worst day happens, there isn’t a sense of panic because everyone knows their roles and responsibilities.”

If you suspect internet crime, utilize the official U.S. government site for internet crime: ic3.gov.

by Sally Colby