July_2021 - 30

someone has probably found you. It's crazy not
to be doing something, and that something has
to include both your backend systems and your
people because that is how they are getting to you. "
Print a plan
Chris Sandberg, vice president of information
security for Trimble Transportation, said that larger
fleets tend to have better cybersecurity plans
than smaller carriers. But no matter the business
size, a company's cybersecurity plan should start
with examining its critical workflows, he said.
" Figure out what workflows are actually critical
to your system, " he said. " Then make sure you document
those workflows. I always encourage people
to make sure that you print them out and redo this
at least annually, if not quarterly. "
The printouts should include workflows and
who has access to what information and network
systems. The hard copies should also include
procedures and phone numbers to call if there is
a system breach. Sandberg suggests putting all of
this critical information " in big red binders and
put it everywhere. "
While creating these documents of company
workflows and information, Sandberg said, fleet
managers and executives will learn more about
their critical processes, such as who has access to
what within the system.
" From there, make sure only the people that
need access have access, " he suggested as a way
to tighten control. Most importantly, Sandberg
said, have an offline system.
" It can be something as simple as somebody
writing a little [computer] script, copying the files
to another file share that the main users don't have
permission to [access], which is what we call an
offline backup, " he explained. " So, if someone
90% of
cybersecurity
problems originate
from human error
Sources: FBI, Cybint, Travelers
16,012
victims
of online employment
scams in 2020
55% of U.S.
businesses
have cybersecurity
insurance
gets infected with something like a CryptoLocker
virus, they can't screw up the backup. "
How often a company backs up its system
depends on the business, Sandberg added.
" It depends on the criticality, " he said. " If the business
can accept losing a day's worth of data, back it
up once a day. If they can accept losing five minutes
of data, copy it every five minutes. The criticality
of the data is what drives the backup schedule. "
McLeod's Barnes said it's important for fleets to
have a playbook ready in case they are attacked so
they're " not reacting in a panic. " He also suggested
that fleets get cybersecurity insurance.
Training and education
CarriersEdge's Jazrawy said the most common
risk to fleets right now is employees clicking on
the wrong links in emails that look legitimate but
lead to " a nasty website or downloads some sort of
malware. " She said employees in her company had
received emails mimicking Jazrawy that ask those
employees to do a task for her, such as buying
gift cards and relaying the gift card information
back via email.
" Another time, I had a staffer get a fake email
from me asking them to email back their phone
number, claiming I needed to call them, " she
said. " This was ridiculous because I already have
everybody's numbers. But if they send back their
number, then [the phisher] tries to call you and
take it further somehow. "
McLeod's Barnes said he's commonly asked how
many clicks of a bad email link it takes to infect a
company's system.
" One, " he said. " It only takes one click if you
open something bad. "
All of this is done by cybercriminals who are
trying to infiltrate companies through employees.
" People are by far the weakest link, " said Jazrawy,
whose company creates training programs for
drivers and fleets. And a newer " people target "
is truck drivers.
" The biggest risk that I see right now is that
companies aren't training their drivers because
they think that the only people who need to be
trained about cybersecurity are the
people in the office because those are
the people who are using the system, "
Jazrawy said. " I think that's a very
dangerous way to think because the
drivers might not be using your systems
directly, but they are certainly talking
or sending messages back and forth to
the people who are using your system.
What are they forwarding or doing
without understanding? "
Barnes said companies are looking
for a 100% guarantee that cybercriminals
won't get into their systems.
" I don't think that exists, " he said.
TOP OF THE LINE
COUPLING COMPONENTS
SINCE 1924
WWW.PREMIER-MFG.COM
FleetMaintenance.com/Inquire
2107FMS_PremierMfg.indd 1
30 Fleet Maintenance | July 2021
6/9/21 4:44 PM
" You have to do the right things. Getting
more preventive is like how you eat an
elephant-you take one bite at a time. If
you've done that and you look up and
half the elephant is gone, then you're
into some really good, multiple phases
of your security approach. "
He added that those " first few bites
of the elephant " aren't going to cost a
company a lot in their cybersecurity
journey. Just having data backup
systems can go a long way.
" If you can't 100% prevent an attack
and an attack happens, what do you
do? " Barnes posed. " Having a good back
http://WWW.PREMIER-MFG.COM http://www.FleetMaintenance.com/Inquire
July_2021

Table of Contents for the Digital Edition of July_2021
