Whether we are using cameras and security systems or phones and computers, data is everywhere. Cyberattacks seem to be on the rise, even at the farm level. During a recent PDPW Dairy Signal broadcast, Jeremy Cherny with Tobin Solutions outlines the importance of keeping your farm data safe.
CIA Triangle
“If you can’t get access to your information, we consider that a security issue,” Cherny says.
He outlines three legs in the breach in your farm’s CIA.
- Confidentiality. An unauthorized party gains access to systems, resources and data.
- Integrity. Data is altered or corrupted by an unauthorized party.
- Availability. Systems, resources and data are not available.
Cherny says anytime a leg of the triangle is violated or breached is considered a security event and the goal is to try and identify those legs ahead of time.
“Do your best to try and reduce or prevent cyber threats and also be able to successfully recover if and when it inevitably happens in some way,” he says.
Not If, but When and How Bad
Unfortunately, with cyber threats a headline topic, the question is not if, but when and how bad a cyberattack will be. People think of security as something they are just going to buy, but Cherny says he wants people to think about it as a process.
He says it’s like purchasing a lock for your front door and that it provides you some security. However, there are additional steps that you must take. You must install the lock properly, close the door behind you, and jiggle the handle to ensure it is locked and secure.
According to Cherny, the first step is having a cyber assessment to outline what is potentially at risk on your farm.
“If IT is not doing an assessment, you’re likely going to have a blind spot,” Cherny says.
By having an assessment, you can see what part of your operation is potentially at risk. You then can ask yourself what kind of impact a cyberattack would have on your operation?
Cyber Liability
While cyber liability used to be an afterthought, as farms utilize more technology and have more data on their operation than ever before, Cherny strongly encourages business owners to consider cyber insurance for what might be at potential risk.
“Cyber liability used to be the kind of thing that was thrown in with a lot of business insurance policies. And you may have a policy where it’s still part of it. But a lot of times now it’s being carved out, especially in renewal time, and it’s getting its own premium, or to expand coverage from what you’ve got in your basic plan,” Cherny says.
When determining an insurance value for potential cyberattacks, Cherny advises farmers to consider the computer costs to get everything back up and running, as well as the impact the downtime has on your operation.
“Even a fairly small cyber threat can potentially cost the producer $10,000 or more,” he says.
Your current IT provider can walk you through a security assessment, as well as provide an estimated cost to potential cyber security risks. Cherny suggests walking through your operation with a fine comb and understanding what area is the most vulnerable and the area that is the most important in terms of your farm’s intellectual property.
The 3-2-1 Plan
Cherny recommends following the best practices to keep your data safe, including the 3-2-1 backup rule which he says is an easy and effective strategy to prevent data loss.
- Create 3 copies of your data: 1 primary and 2 backups.
- Store your copies in at least two types of storage media (portable drive, network storage, drive).
- Store one of those copies offsite (in the Cloud) and air-gapped/offline if possible.
The same rule applies to a cloud-based service and Cherny encourages you to read the fine print when storing to systems like Google and not assume that they cover cyber threats.
Finally, in the unfortunate circumstance, you are hit with a cyberattack, there are three aspects to consider when determining the right disaster recovery solution:
- Recovery Point Objective. How current your data is at the recovery site?
- Recovery Time Objective. How long it should take to bring an environment back online once a disaster or major incident is declared?
- Maximum Tolerable Downtime. What is the amount of time you are willing to accept for a mission/business process outage or disruption and include all the impact considerations?
To learn more about cybersecurity and to watch the broadcast in its entirety, go to pdpw.org/the-dairy-signal.
