The Covid-19 pandemic has made cybersecurity more important than ever for consumer goods companies, says a new research paper – warning a successful cyberattack can bring a business “to its knees”.
In its recently published Cybersecurity in Consumer Goods report, GlobalData forecasts cybersecurity revenues generated in the consumer goods sector will increase from US$3.9bn in 2020 to $6.5bn in 2025, representing a compound annual growth rate (CAGR) of 10.6%. Those revenues cover hardware, software and services, taking in areas such as firewalls and VPN appliances, data protection, and emergency incidence response.
Cyberattacks have made the headlines frequently in recent years, with examples in the beverage sector including disruptive attacks on food and beverage companies such as Mondelez International, meat giant JBS, Molson Coors, Campari Group and, this week, European frozen-food business Apetito.
“The pandemic has accelerated the digitalisation of business operations and has normalised remote working and e-commerce,” says the GlobalData report. “This means consumer goods companies have become more reliant on information technology (IT) and operational technology (OT) systems that are connected to both the internet and the corporate network, increasing the attack surface available to threat actors.
“It also means consumer goods companies are storing more and more consumer data. Failure to protect this data can cause severe reputational damage and incur serious fines if a company has failed to comply with the EU’s General Data Protection Regulation (GDPR).”
This scenario makes corporate investment in cybersecurity a must, the report argues, warning: “A successful cyberattack can bring a consumer goods company to its knees. Ransomware can force companies to halt production by crippling IT and OT infrastructures and disrupting supply chains.
“The combined costs of stopping production, restoring or replacing compromised equipment and, in some cases, paying the hackers their ransom can be enormous.”
The report outlines the value chain that underpins cybersecurity, from cybersecurity hardware (such as chip-based security) to the complex landscape of cybersecurity software, which encompasses a number of aspects, including:
- Identity management: Ensuring that only authorised individuals have access to the tech systems needed to do their job, and preventing unauthorised access.
- Network security: Using specialised hardware and software to protect the networking infrastructure from unauthorised access, misuse and damage. Traditionally, corporate networks would be protected by a firewall in what was known as a “castle-and-moat” model, but remote working has transformed this, opening up organisations to increased threats from hackers.
- Endpoint security: Protecting the network when accessed by an endpoint device (laptop, smartphone, etc). One of the commonest forms of cyberattack.
- Threat detection and response: Identifying threats and responding to neutralise them.
- Cloud security: Protection of cloud data, applications and infrastructure, including public, private, hybrid and common cloud services. The highly connected nature of cloud environments means that insecure APIs (application programming interfaces) and account hijacks can cause real problems.
- Email security: Another common attack method used to spread malware and phishing attacks, and a favourite way for hackers to gain a foothold in an enterprise network and obtain valuable data.
- Application security: The development, addition and testing of security features within IT applications to protect against threats, including unauthorised access and modification.
- Unified threat management (UTM): UTM can be used to protect single devices through multiple security features, such as antivirus, content filtering, email/web filtering and antispam.
The report also outlines the range of cybersecurity services available, such as post-breach response services, which include the prevention of further data loss or damage, the preservation of evidence to document the data breach, and investigating to detect the source of the attack.
“Every business will likely have to deal with a cybersecurity breach at some point,” the report points out. “Of course, prevention is always better than a cure, but when an organisation has been affected by an unwanted incursion that has compromised its systems, it will need remedial services to address computer network and system issues, and any vulnerabilities identified.”
Meanwhile, organisations can help protect themselves against future attacks through the use of risk and compliance services – to better understand their current cyber risk and capabilities, and to guide future cybersecurity investment as a result.
“Risk and compliance services can help organisations stay up-to-date with developments in areas such as data security and data privacy, and cope with a constantly evolving threat environment and regulatory landscape,” GlobalData says.
Connected to this is the area of identity and access management services, helping companies to identify who has access to their resources – and the report adds that risk and compliance services in general can help give organisations greater resilience in facing future cyber threats.
Identifying case studies of consumer goods companies and the steps they have taken to counter cyber threats, the report highlights The Coca-Cola Company, which partnered with Sangfor Technologies in 2019 to improve the cybersecurity of its bottling operations in China.
The tie-up came as a number of businesses across China faced the threat of the Driving Life virus, which was capable of evading traditional virus detection systems by regularly mutating and spreading through networks at speed. According to Sangfor, its endpoint security solution, Endpoint Secure, eliminated Driving Life and safeguarded Coca-Cola’s systems “in minutes”.
GlobalData also notes that The Coca-Cola Company is a client of Claroty, a specialist in the field of industrial cybersecurity, but it warns that even these steps will not necessarily protect businesses from all forms of cyberattack.
In particular, it flags up a vulnerability shared by Coca-Cola and many other consumer goods companies: their reliance on other, third-party organisations that may be cyber-vulnerable. In this way, Coca-Cola was affected by two separate attacks in 2021: one on Hong Kong marketing business Fimmick, which had the company as a client; and the other on payroll company Kronos, which impacted a number of businesses and disrupted Coca-Cola’s digital timekeeping and staff payment systems.
“Coca-Cola has taken a greater interest in its cybersecurity over the last year,” the report says. “Mentions of cybersecurity in its filings tripled in 2021, and it posted 10 times as many cybersecurity-related jobs in 2021 than 2020.”
For more details on GlobalData’s ‘Cybersecurity in Consumer Goods’ report, click here.
Related Companies
