Security is an important and multi-faceted concern for the logistics industry, including both physical and cyber components. To minimize the risks of theft, sabotage, and other threats, logistics companies typically invest heavily in physical security devices such as cameras, sensors, and access control panels. But without adequate operational management, those devices do not always deliver the security on which logistics companies depend. Even worse, those devices can become an easy target for hackers eager to carry out a damaging and costly cyberattack.

Logistics companies face serious threats to their cybersecurity and physical security

Across the logistics industry, companies know they need to defend themselves from serious security risks. Thefts in places such as warehouses, ports, and various types of vehicles transporting goods and raw materials can be an expensive problem. Logistics companies also need to defend themselves against the danger of sabotage, whether carried out by state or private actors.

Data from the FBI shows that more than $33 billion worth of cargo was stolen in the U.S. in 2018 (only 22.8% of which was later recovered). Since then, criminal gangs have become more sophisticated in their methods, contributing to an estimated 20% jump in cargo thefts in 2022. So far in 2023, food and beverage products have been reported to see the most significant increases in cargo theft, costing an average of $214,000 per incident.

But as serious as physical risks are for logistics companies, perhaps their greatest security threats come from hackers. Logistics companies can be an attractive target to threat actors not only because of the volume and value of many of the items these companies transport, but also because of the sensitive nature of much of the customer information they store and handle. In addition, they can be a particularly lucrative target for state actors, especially because logistics companies can be massive in size, and critically important to major supply chains on which consumers and businesses depend.

Unquestionably, the clearest example to date of how much damage a cyberattack can do to a logistics company is the 2017 breach of global shipping company Maersk. In that incident, the NotPetya virus – a cyberweapon first used by Russian hackers against Ukrainian targets – infiltrated a Maersk computer in Ukraine and then spread rapidly throughout the company’s worldwide networks. The bug wreaked havoc on Maersk’s operations, ultimately causing the company between $250 million and $300 million worth of damage, according to the company’s own estimate. 

And future cyberattacks could be even more harmful, especially because digitalization is taking place rapidly throughout logistics companies, and not only in the realm of physical security. As connected technologies play an increasingly important role in shipping operations, there is a growing risk that threat actors could use vulnerabilities in physical security devices to hack into logistics companies’ systems and interfere with their core operations. And as trends like driverless shipping via truck or rail become increasingly widespread, that danger will undoubtedly continue to expand in the future.

How effectively do logistics companies’ physical security devices meet their needs?

As the logistics industry has increasingly embraced digitalization, its physical security efforts have come to depend heavily on connected technologies such as cameras, sensors, video analytics, and access control panels. 

But while logistics companies invest heavily in these physical security devices, in many cases they cannot be counted on to actually deliver the level of security those companies need. Even worse, they can jeopardize the cybersecurity of logistics companies by providing threat actors with easy targets to attack.

The problem is that after logistics companies buy physical security devices and get them installed, they often aren’t able to use them to their fullest potential. That’s not the fault of the manufacturers and systems integrators who sell and deploy them, nor is it the fault of the physical security teams themselves. It is simply the reality of the conventional approach to operationally managing physical security devices – a status quo that does not adequately address the need to maintain these devices. 

Notably, this problem is not unique to the logistics industry. In fact, the average organization operates in a physical security environment in which:

• 4% of physical security devices get disconnected from their network at some point in a typical week.
• 6% of IP cameras get disconnected from their video management system at some point during a typical week.
• 8% of physical security devices are misconfigured.
• 15% of physical security devices in use are past their end of life, meaning that they are no longer supported by their manufacturers.
• 70% of physical security devices are running outdated firmware. 

The status quo hurts the logistics industry’s overall security posture

Because logistics companies (like most organizations) can’t scalably manage their physical security devices adequately, they face a real risk that one or more of these devices could be down when it’s really needed. In case of theft, sabotage, accident, or other serious incident, this could leave a logistics company exposed to real physical security risk.

Perhaps even more troubling for logistics companies is the cybersecurity risk posed by physical security devices that are not adequately hardened and maintained. Probably the most notorious example of this danger is the 2021 hack of video security startup Verkada, in which hackers gained access to roughly 150,000 security cameras. And this risk is extremely widespread, with nearly 40% of security cameras having cybersecurity vulnerabilities as a result of running outdated firmware, according to Genetec. Accordingly, the Biden-Harris Administration’s new National Cybersecurity Strategy document notes that “many of the IoT devices deployed today are not sufficiently protected against cybersecurity threats.”

Helping to quantify the danger of a cyberattack for the logistics industry, in 2022 IBM estimated the average cost of a data breach affecting the transportation industry (including shipping companies) to be $3.59 million.

Given the risks presented by inadequately managed physical security devices, why don’t logistics companies address this issue more comprehensively? The reality is that the operational management of physical security devices is simply too time-consuming and cumbersome to be feasible and affordable for logistics companies (and for most other types of organizations).

Making their operational management particularly difficult is the variety of time-consuming, unscalable tasks involved in operationally managing physical security devices, including: 

• Rotating passwords.
• Upgrading firmware.
• Managing certificates.
• Monitoring devices to ensure they run consistently and securely.
• Replacing devices that are past their end of life.

Logistics companies need a more effective way to manage their physical security devices

In light of the risks that logistics companies face due to their inadequately managed physical security devices, how can they change this reality and make sure their physical security devices can be relied on to run consistently and securely? How can they ensure their security devices bolster their security posture rather than leaving them exposed to physical and cyber risks?

The key to solving the problems surrounding physical security devices isn’t doing more of the same. Logistics companies need an entirely new approach, and the way to achieve that goal is through automation.

By automating the operational management of physical security devices, logistics companies can minimize the likelihood of a device being offline when it’s really needed. And perhaps even more importantly, this approach can help the logistics industry ensure that its devices are hardened and maintained consistently, in line with cybersecurity best practices. 

This way, logistics companies can bolster their security across the board, helping protect themselves, their employees, their customers, and others from both physical dangers and cyber threats. And they can do all of that reliably, efficiently, and cost-effectively.

Learn how the SecuriThings Enterprise Solution enables physical security teams to automate the operational management of their devices.