Earlier this week, an alert came across my threat intelligence feed that confirmed a point I have made more times than I can count: Small fleets are being targeted by cyberattacks frequently.
There’s no such thing as “too small to be a target.”
The fleet in this alert operated only 11 power units. This was not a large, well-known fleet with a national footprint. This was a small, independent trucking company that became the latest in a long string of similar victims of devastating cyberattacks.
I hear the same reasoning from small fleet owners all the time: We’re too small. We don’t have anything worth stealing. No one is going to bother with an operation our size.
It’s a comforting thought. It’s also exactly backwards.
The attacks that hit fleets like this one are not targeting them specifically. They are automated attacks aimed at anyone with a vulnerability that can be exploited.
The bad actors run automated tools that scan massive swaths of the internet at a time, looking for unpatched systems, exposed remote login portals, or accounts using default credentials or credentials that they found in dumps on the dark web.
These tools don’t care about your P&L or the number of trucks you operate. They’re simply knocking on every door they can, waiting to find one that’s been left unlocked.
Target of opportunity
The cybersecurity industry has a name for this that you will find throughout the NMFTA cybersecurity guidebooks: A target of opportunity.
A small fleet may not be targeted specifically because of who they are, but they WILL eventually get hit if they’re not properly protected.
Devastating consequences
For a small fleet, the consequences of being hit by a cyberattack are often much more devastating than for a large operation.
Why? Large fleets often have the margins and the cash on hand to keep the doors open and absorb the hit. They have security teams and likely an incident response firm or cyber insurance breach coach on retainer. Large fleets with a mature cybersecurity program will have backups in a second data center and a team that’s been trained to restore them quickly and get the operation moving again.
An 11-truck fleet often has none of this. There’s no backup site to fail over to. When ransomware locks up the few machines that hold the company’s invoices, driver settlements, etc., there is enormous pressure to simply pay the ransom.
Every day the operation is offline is one day closer to the day the operation shuts down for good.
Don’t wait for a cyberattack to defend yourself.
So, what does a small fleet do to defend itself against the same threats aimed at the large, national carriers?
This is where we’ve got some good news: Most of the controls that can shut down these opportunistic attacks are the ones that are within everyone’s reach. They are not exotic and most cost little or nothing to implement, even without deep technical expertise.
NMFTA has published a free Cybersecurity Best Practices Guidebook — for Owner-Operators and Small Fleets that explains essential cybersecurity practices in plain language and in the order a fleet should tackle them. A small handful of these controls do the heavy lifting and will raise any operation out of the “low hanging fruit” range that the bad actors successfully target so regularly.
Best practices for security
Start with multi-factor authentication (MFA). This can defeat a stolen password before it becomes a breach. Turning on MFA everywhere it’s offered is the single highest-value thing a small fleet can do. Pair MFA with strong, unique passwords — one per account. Store these passwords in a secure password manager so you don’t need to remember them all.
RULE OF THUMB: Never share passwords between users.
One more word on passwords before we move on. Any time you get a new device, such as a router or a camera, make sure you change the default password immediately. Those default passwords are published on the internet and are the first thing a bad actor is going to try when they attempt to break into your organization’s network.
Require a PIN — or better yet, a fingerprint or face unlock on every device that touches the business. This means a lost laptop is a dead end rather than an open door to your company’s data.
It’s also important to understand that unsupported software stops getting the security fixes that keep attackers out. With this in mind, keep your operating systems and software patched, turn on automatic updates where you can, and make a plan to retire anything the manufacturer no longer supports.
Back up your data using the NMFTA guidebook’s 3-2-1 rule: 3 copies, on 2 different kinds of media, with 1 kept off-site or offline. Reliable backups are what turn a ransomware attack from a business-crippling event into a bad afternoon — but only if you have actually tested a restore. Relying on a backup you’ve never restored from is a guess, not a plan.
Spend some time teaching your team how to recognize a phishing email, and what’s at stake if a cyberattack is successful.
Work with your entire team to develop and write down an incident response plan. This doesn’t have to be a 30-page binder full of technical details, it needs to cover who to call, how to get hold of them, and how to keep your operation running during a cyberattack. Keep a paper copy of this plan so that you can access it even if all of your computers are locked up by an attack.
If you only take away three points from this article, make them these:
- Turn on MFA everywhere it’s offered, starting with your email and any financial or operationally critical systems.
- Set up your backups that follow the 3-2-1 rule.
- Write out your incident response plan and put a printed copy somewhere you can find it during a crisis.
None of these controls require a change to your budget, or an expensive security consultant; all three are within your reach right now.
The fleet that was hit this week was not hit because they were large or important. That fleet was reachable online, and it was unprotected. “Too small to be a target” is not a strategy — it’s an expensive assumption.
Ben Wilkens, CISSP, CCSP, CISM, is director of cybersecurity at the National Motor Freight Traffic Association Inc. (NMFTA).
In his role at NMFTA, Ben spearheads research initiatives and leads teams dedicated to developing cutting-edge cybersecurity technologies, methodologies and strategies to safeguard information systems and networks. He collaborates extensively with academic institutions, industry partners and government agencies to advance cybersecurity practices and knowledge.
Ben provides expert insights and recommendations to organizations, enhancing their security posture and helping them navigate the constantly evolving landscape of cyber threats.
Before joining NMFTA, Ben was a key executive at a third-generation family-owned trucking and logistics company. There, he focused on the strategic integration of technology to improve operational efficiency while ensuring adherence to cybersecurity best practices.
With a rare combination of CISSP, CCSP and CISM certifications — alongside an active Class A CDL — Ben brings a unique perspective to the intersection of cybersecurity and transportation. In addition to his extensive experience as an over-the-road driver, he has held roles in dispatch operations, driver management, and brokerage sales. Ben later transitioned to IT and operations support, where he honed his expertise in cybersecurity.
