Cybersecurity question checklist for the animal protein industry
An adviser at the Bioeconomy Information Sharing and Analysis Center (BIO-ISAC) urges meat and dairy producers to put a set of cybersecurity questions to technology vendors. The sector is heavily digitized, so an attack can disrupt production and the wider supply chain.
Andrew Rose, a BioAg adviser to the Bioeconomy Information Sharing and Analysis Center (BIO-ISAC), has told AgFunderNews how meat, poultry, swine and dairy businesses can reduce their exposure to cyberattacks. BIO-ISAC has put together a list of questions that producers can ask agricultural technology vendors. It matters because the sector increasingly depends on connected equipment, and downtime can disrupt the entire supply chain.
Why the sector is exposed
Animal protein production uses robotic milking parlors, automated feeders and environmental controls for poultry houses, hatchery management software and swine barn ventilation systems. Rose says every connected device is a potential entry point for attackers.
The source cites two examples. In 2021, meatpacker JBS halted operations at 47 sites worldwide and temporarily laid off staff after a ransomware attack. In 2023, a Swiss dairy farmer lost access to his cows' health information when criminals locked his system and demanded $10,000; a calf died in utero and the cow had to be euthanized.
What to ask vendors
The checklist covers several areas:
- Passwords and access: whether default passwords can be changed, multifactor authentication enabled, and whether accounts are shared. Rose stresses that default passwords remain one of the most common entry points.
- Data: what is collected, where it is stored, who owns it, and whether it can be exported or deleted.
- Network and devices: whether the system can run on a segmented network and without internet access. Flat networks, where all devices share one environment, risk a single device compromising the whole operation.
- Updates: equipment often stays in service for ten to twenty years, so support duration and response to vulnerabilities should be checked.
- Incidents and liability: how fast a vendor will report a breach and who is responsible for downtime or animal losses.
- Remote access, interoperability, supply chain and continuity, including manual control of feeding, ventilation and refrigeration if systems fail.
The list also includes internal questions for staff, such as recognizing phishing, restricting USB devices and promptly removing access for departed employees.
