How should companies in the port and transportation logistics sector tackle cybersecurity? Can smaller and midmarket companies even protect themselves against the growing threats? Our CTO Ralf Kempf and his colleague Norbert Klettner, Managing Director of AKQUINET PORT CONSULTING, were interviewed on this subject by DVZ, a German transportation newspaper.
Excerpts from the interview are provided below.
DVZ: What exactly do cyberattacks on companies in transportation, logistics, and shipping look like?
Ralf Kempf: The attack pattern is usually similar: The virus enters the network through an unprotected user or computer. If any of the infected computers has an active VPN, the spread of the virus is nearly impossible to stop. This has happened to quite a few large logistics companies. The attackers are very professional and send emails that appear to be very genuine. This attack vector is not limited to the logistics sector, of course; it is used everywhere, every day.
DVZ: Does it affect smaller companies more than larger ones?
Norbert Klettner: No, but we often only hear about attacks on large corporations in the media. Smaller companies are just as affected. After all, particularly in the transportation, logistics, and shipping sectors, many players interact with one another, are connected around the world, and exchange data through a wide variety of systems. Imagine it as a huge, highly fragmented system with many individual gears. Attackers seek out the weakest link in the chain: usually smaller, less protected companies where a cyberattack can succeed quickly.
DVZ: Do the companies in this sector protect themselves less than companies in other sectors?
Norbert Klettner: You could say that businesses here have largely been managed “traditionally” for a long time. Port logistics companies, for example, concentrate on loading and unloading ships most efficiently. The central importance of the technologies behind these processes, which now represent their backbone, reached the management board later than in other industry sectors. In the meantime, large companies have developed cybersecurity strategies, but many midmarket companies have not yet.
DVZ: Is the risk from cyberattacks still underestimated?
Norbert Klettner: Many companies suspect or even know that there are vulnerabilities in their systems. Nonetheless, they either think, “What can I do about it anyway?” or, “I won’t be affected.” But giving up and hoping aren’t viable company strategies.
Ralf Kempf: Yes, it’s truly alarming how often companies are quite aware of vulnerabilities, but do nothing to eliminate them. Findings from security audits often remain hidden in drawers. This is because these companies lack a culture where mistakes are allowed, where the only things that matter are creating transparency and identifying faults. Instead, the focus often lies on perceived employee misconduct, however unintentional it might be.
DVZ: To what extent is it even possible to protect yourself?
Ralf Kempf: The best response to a cyberattack is highly dependent on the respective attack vector. But what all responses have in common is that they require a clearly organized risk management structure at the company, with defined processes on how to proceed through risk scenarios. We often advise companies with SAP systems and we’ve noticed that many system managers shy away from securing their systems completely – because this requires a project budget, as well as permanent staff resources. But this expense is very small compared to the damage that criminal hackers can cause.
Article by Claudia Behrend, Dipl.-Jur., author, and freelance journalist.
This interview was published in full (in German) under:
Republished with the friendly approval of DVZ.
Norbert Klettner (Managing Director AKQUINET PORT CONSULTING)
Ralf Kempf (CTO SAST SOLUTIONS)
More articles on the topic of cybersecurity: