7 ways to beef up your farm’s cybersecurity
© Adobe Stock Farming is a critical part of national infrastructure, yet many farmers still underestimate the risk that cybercrime poses to their businesses.
With farms becoming increasingly reliant on digital technology, from livestock monitoring to precision machinery, taking cybersecurity seriously is no longer optional.
Many farmers naively presume they won’t become targets of a cyberattack.
See also: Guide to cyber security issued as fraudsters target farmers
Advice for reporting cybercrime
- Phishing emails: block and report to the National Cyber Security Centre
- Suspicious text messages can be forwarded free of charge to 7726
- If the crime is happening live, ring 999 immediately.
- If you have been subject to a scam or losses, report this to Report Fraud
But that complacency is exactly what cybercriminals exploit, warns David Suffield, cybercrime protect and prevent officer at Lancashire Constabulary.
“We’ve dealt with cases where farmers’ business emails were compromised, and £30,000 was paid into the wrong account,” he says.
“We’ve also noted that animals in Europe have died because data was hacked, so farmers couldn’t see what the collars were telling them.”
Targets
Mr Suffield says farmers are attractive targets for organised cybercriminals because they hold valuable assets such as land, stock and machinery.
Furthermore, they increasingly rely on digital technology that generates vast amounts of data that is valuable to them and can be held for ransom.
“The data you hold about your livestock and crops is just as important as your name, address or date of birth and national insurance number. Guard it like that,” says Mr Suffield.
“You wouldn’t give your house keys to a stranger, yet many people leave their digital doors wide open.”
Mr Suffield says that despite growing cyber threats, an estimated 1m people worldwide are still using the same password across all of their accounts.
“I watch too many farmers put their passwords into their computers while doing social media clips. This is poor cyber hygiene.”
Under attack
There are now 19bn internet-connected devices worldwide, otherwise known as the Internet of Things (IoT), and each one is attacked at least 3,600 times a year, says Mr Suffield.
As farming becomes more digital – with GPS-enabled machinery, animal sensors and wearable technology – exposure to risk increases.
“You don’t have to be Bill Gates or Elon Musk to stay safe. Criminals tend to go for the easiest targets.
“But you can dramatically reduce the risk if you embrace good cybersecurity and hygiene.”
Farmers need to develop their own farm “cyber culture”, Mr Suffield advises, so they can be better prepared and protected when using digital technology on farm.
He offers seven essential tips to strengthen a farm’s digital defences.
1. Use strong, unique passwords and two-step verification
Emails are the gateway into a business. People need to think about emails as a portal into their lives and think about what could happen if their email went down.
Every account should have a strong, unique password that incorporates special characters and numbers.
Ideally, they should include three random words and be at least 15 characters in length.
Farmers should also utilise built-in password generators and keepers, and enable biometric authentication, such as fingerprint or facial recognition, to help manage these.
Two-step email verification and authenticator apps add extra layers of protection against incursion, he adds.
2. Separate personal and business email accounts
If one email address is compromised, this mitigates the risk of the other being affected.
Personal email addresses are often linked to social media accounts, which is a gateway to being compromised.
3. Back up your data regularly
Farm data should be backed up frequently, including offline to external hardware devices, to ensure it can be recovered in case of a breach.
If you have multiple hard drives, keep a register of which ones you backed up which data to.
Write down the date it was backed up in a book and keep this in a very safe place. Know where each hard drive is kept and who has access to it.
4. Keep software updated
Delaying updates can leave systems vulnerable, so it is essential to ensure devices and apps are updated promptly as this can help prevent security breaches.
5. Ensure the device you are using is supported
The hardware on your device may be deemed obsolete by the manufacturer and, therefore, won’t receive security updates.
In this instance, they won’t be able to deal with ever-increasing, complicated cybersecurity threats and updates to run your business.
This leaves users vulnerable and hackers can exploit this.
Older people can also represent a “grey cyber desert”, particularly when they have mobile phones handed down to them by sons and/or daughters, which can be several years out of date.
A quick Google search will determine whether a device or software is still supported. If it is not, it is time to replace it.
6. Ask manufacturers of kit what support they offer
When investing in machinery and software, ask suppliers what cybersecurity and data protection support they provide.
Ask how they protect their machinery and your business from malware and ransomware attacks – especially important if they are handling your farm data.
7. Have a cyber plan
You can purchase cyber insurance and should have a cyber recovery plan in place in case you are subject to a cyberattack.
Keep hard copies of your cyber recovery plan handy just in case. This will ensure you can respond quickly and safely in case of an emergency.
Dos and don’ts to avoid cyberattacks
- Do have wi-fi just for business and consider using other wi-fi setups for contractors or holiday guests.
- Do lock your farm office and machinery.
- Do remove tech devices, such as GPS, from machinery, if possible.
- Do change passwords on the Internet of Things devices you use rather than using generic ones.
- Do report events to reportfraud.police.uk
- Don’t use the same password for multiple devices/apps
- Don’t use old devices that are not supported.
For more information on how to protect your business, visit the National Cyber Security Centre website.
You can also contact your area Cyber Resilience Centre, which provide fully funded services run by the police, government, the private sector and academia.
The aim is to strengthen cyber resilience across the nation for small and medium-sized businesses.
How one American company responded to a major cybersecurity breach
A failed security update in 2021 led to a major hacking of one North American agricultural company, costing it more than $100,000 (£73,500) to resolve.
The company, which wishes to remain anonymous, revealed organised criminals encrypted its systems despite what it believed were “pretty high” security measures.
The firm acted quickly, whisking in UK-based forensic specialists and lawyers to deal with the incursion.
Hackers initially demanded a $1.5m (£1.1m) ransom for the decryption code.
The cybersecurity firm negotiated this down to less than $5,000 (£3,700).
“We were advised to pay them something as a tactic to prevent being targeted again,” their chief executive explains.
“We didn’t need the encryption code because we had full backups, but forensic analysts can use it to see if any data was taken.”
Pen and paper
Investigators confirmed no customer data was compromised.
Back-up servers and cloud storage allowed the company to get back up and running within 10 hours.
However, the business was forced to revert to pen-and-paper systems and notify all customers of the breach.
Since the attack, the business has beefed up its cyber defences.
It has moved to a Nutanix server with dual-layer encryption, adopted Amazon and Microsoft cloud storage, and implemented mandatory two-step authentication for all staff.
It now works with global security firm CloudStrike to monitor systems and employs “white hat” hackers to test security without their IT team’s knowledge.
The company has also begun educating farm customers on cybersecurity.
It is urging them to keep financial accounts separate from farm operating systems, move to cloud-based storage, use high-level authentication, and keep software updated.
“Those without security are low-hanging fruit,” the CEO warns.
“This was a wake-up call to say, ‘you thought you were good, but you’re not’.
“If you’ve been targeted once, you’re more likely to be hit again.
“Now, our security is 20 times stronger, and any attack would be quickly shut down.”