Logistics in digital age: Data protection as key element of success

Data security in logistics is key and should definitely not be underestimated. It is necessary to realize that digital technology and information systems, which are already indispensable for the efficient operation of logistics processes, face and will continue to face various security threats.

Cyber risks threaten information systems in logistics in the same way as in other fields. "In general, the most common types of cyber attacks are malware and phishing. For a logistics company, a successful attack can have a very serious impact, as it quickly affects operations and causes large losses," explains Michal Kárník, chief information officer at Aimtec. Companies reduce this risk by improving the security of end devices and the availability of critical applications.

Cyber threats in logistics are not specific compared to other segments, believes Miroslav Králík, delivery manager of LOKiA WMS at GRiT. According to him, it is essentially the same corporate infrastructure, the protection of which must be ensured regardless of logistics. "However, if I were to think about what is specific about data security in logistics compared to other fields, it would be the necessity of its internal protection. Most companies deal with network protection from the outside. In logistics, however, it is common for employees or seasonal part-timers to work with sensitive customer data that can be misused. It is therefore up to each company to decide who to let access which data and whether seasonal part-timers or just regular employees will work with sensitive GDPR data," notes Miroslav Králík.

Clear goal

Large-scale hacker attacks that also affected logistics and transport companies last year and this year are still in vivid memory. According to Petr Loužecký, director of cloud services at Algotech, these companies are a highly visible target for attackers. "Part of the manufacturing companies will have to comply with the new legislation associated with the European regulation NIS2, which determines the IT security of data and systems. Due to the responsibility of companies, these rules will be transferred to their suppliers, including logistics companies," Petr Loužecký points out. In addition, logistics operations use specific devices that move outside the standard IT environment; these are, for example, readers, terminals or even systems that track trucks on the road. These devices can be relatively easily exploited for an attack, or their damage can trigger faulty process control and thus cause significant damage to the company.

A typical example of a cyber attack is so-called ransomware, when data is encrypted and a subsequent request for payment of a ransom occurs. "In some cases, the primary target is not directly a significant company, but, for example, its supplier. There is usually a large number of suppliers, and therefore it is easier for an attacker to disrupt the business of the target entity through an attack on a third party," states Jan Burian, head of IDC Manufacturing Insights EMEA at IDC, and points to a number of cases that were also reported by the media. Among the most famous is the "case" of the Maersk company from 2016, when more than 50,000 end devices and thousands of applications were affected by the WannaCry ransomware. "In recent years, attacks on infrastructure have significantly intensified, while as a result of the war in Ukraine, the security of logistics also takes on a national-strategic dimension. Logistics in general can be considered a part of critical infrastructure, and therefore even logistics companies are in the crosshairs of attackers from countries that are not exactly in favor of Western society," adds Jan Burian.

Data security in logistics is essential, for example, in connection with the processing of data from e-commerce. „In order to quickly process orders and ship them to customers, it is essential to verify that orders are from legitimate customers, as well as to prevent unauthorized accounts from blocking goods in warehouse. An important factor is the synchronization of stock levels from the warehouse system with online sales systems, including setting the price policy and discount coupons, while the greatest sensitivity is to wrong prices and incomplete deliveries of quantities," explains Pavel Motan, CEO of K2 atmitec. Security also includes technical measures against intrusions into the system, such as reading barcodes, identifying goods, correctly assigning customers and carriers, and dealing with non-standard situations such as order changes, cancellations or unpaid invoices (but the goods is still shipped to the customer, etc.). "If the company carries out its own delivery, it must also deal with the identification of the customer when handing over the goods and the method of handing over, which can be complicated by various factors such as returns, damaged packaging and different payment methods," explains Pavel Motan. The advantage is when the documents are created online when handed over to the customer and changes are recorded in the system immediately.

Pitfalls of „invisible data“

Mobile devices such as readers or scanners used in logistics processes to access data. A large amount and diversity of data - both about the goods themselves (master data, stock, value) and about their movement, but also about customers, suppliers or employees. A high degree of automation and digitization, typical of logistics. All of this, as inevitable as it is in itself these days, exposes logistics operations to a higher level of security risks.

"I subjectively perceive one more problematic aspect: 'blinding by physical movement'. In logistics, it is mostly about physical movement – of goods, deliveries, components. When it works smoothly, many employees in logistics are no longer interested in checking the flow of data – it is 'not visible' after all," says Petr Jahoda, CEO of Resultful. Fields that only have data and not a physical product (e.g. software companies, but also Instagram influencers or tiktokers) are constantly interested in this data. “It is their bread and they have nothing else. On the other hand, we in the supply chain sometimes have a tendency to unwittingly underestimate data," he points out. To prevent risks, it is advisable to use the proven security trio: firstly, it involves the implementation of robust security technologies, secondly, the introduction of control mechanisms and preventive measures, and thirdly, the training and responsibility of employees. "From my experience, I place particular emphasis on the third point, i.e. the employees. The first two items are a more manageable process with only a few risk points. On the other hand, there are many employees, their interactions with the systems are even more plentiful, and an insufficiently trained or motivated employee can cause a lot of damage even unintentionally," adds Petr Jahoda in conclusion.

Article was prepared by David Čapek and published at systemylogistiky.cz

‍