Back in August, the Associated Press ran this article profiling how a North Carolina manufacturer has been attacked twice by cyber criminals looking to install malware and cripple the “just-in-time” nature of their operations so that they’d be willing to pay a ransom to return to production. While this manufacturer avoided paying the ransom so far, the first attack did result in four hours of downtime – which their plant’s IT Manager identified as a risk in excess of US $1 million.

Supply chain cyber-attacks are not new. As cyber criminals become more adept at attacking business infrastructure, especially legacy and industrial control systems that are particularly difficult to protect, we can expect their focus to expand to anyone whose operations they can disrupt for ransom. According to Cisco’s 2017 Annual Cybersecurity Report, ransomware is growing at a rate of 350% annually, and ransomware exploits earned criminals US$1 billion in 2016. Just because your business isn’t the Internet, finance or health care doesn’t mean cyber criminals won’t target you.

In addition to protecting your organization with strong technical controls, sound information governance, and continuous security awareness training, take these steps to further reduce risk:

• Ensure everyone in your organization knows how to report an incident
• Create and maintain a thorough Incident Response Plan
• Practice Business Continuity and disaster drills to be sure you have contingencies in place to work around disruptions
• Assess your cybersecurity insurance coverage
• If you do business in or with Europe, ensure you’re familiar with the upcoming General Data Protection Regulation (GDPR) and which systems hold personal information of your customers