Lowering the risk of cyber attacks in aquaculture

Data sharing not only leads to better data security, it helps build tools that will benefit the entire industry.

This article originally published on SalmonBusiness.com on 18 Feb. 2021.

On Sunday 10 January, AKVA Group was the victim of a ransomware attack that took down several of its systems. The company gave no comment on the ransom amount, or whether or not they paid.

These cyber-attacks are happening more frequently in Norway, hitting both the public and private sectors. A ransomware attack halted production at Norsk Hydro in 2019. Akva Group’s competitor Steinsvik (ScaleAQ) was attacked last April. This past December, the cruise line Hurtigruten and the Østre Toten municipality were both hit by significant ransomware attacks.

As ransomware attacks become larger, more frequent, and more sophisticated, all companies need to reexamine their strategies. Too often, “data security” is no more than a marketing tagline.

How ransomware attacks work
Attackers commonly gain access by phishing, or impersonating a trusted source—such as an employer, bank, or the government—and sending malicious email attachments or links that infect the victim’s computer. They can easily find personal details like names, job titles, phone numbers, and other information to build credibility.

Attackers can also gain access without any communication: finding flaws in the company’s system. Many use bots to constantly scan websites and applications across the internet for outdated or unpatched systems.

Once the system is breached, the attacker will encrypt the company’s files, making them unusable. They will then notify the victim of the breach and demand ransom for access.

What companies can do
There is no such thing as 100% security; anyone on the internet is at risk of getting attacked. But basic precautions can significantly lower a company’s risk.

For all employees (especially executives):

1. Avoid opening emails from suspicious senders, downloading strange attachments, or clicking on suspicious links.
2. Always keep software up to date. Most of the time, updates from Windows, Mac, Java, and other software include important security patches.
3. Use a password manager so that passwords can be made more complex and secure.

For companies:

1. Promote security awareness within the company so that all employees know how to spot a phishing attempt.
2. Properly restrict permissions and access to company systems.
3. Invest in software to scan emails for malicious links or attachments.
4. Encrypt databases and all passwords.
5. Keep periodic offline backups, separate from the system.
6. Separate the critical infrastructure from the non-critical.
7. Always keep systems up to date: ensure that firewalls are closed off to the right IP addresses, vulnerable ports are not open on the servers, databases are updated, etc.

Open systems in for data security
Aquaculture technology companies deal with sensitive and confidential farm data. But this information is not made safer by shutting off doors. If a company’s system is locked up and closed off, it’s more likely that its vulnerabilities go unnoticed, leaving them for hackers to find.

Google takes advantage of open systems by inviting the public to find security vulnerabilities. Its Vulnerability Reward Program offers a bounty USD 133,337 for the most critical flaws discovered.

Manolin uses the ScaleAQ Mercatus open API to retrieve customer data, and we recently got an alert that our Mercatus data pipeline had gone down. The company had pushed a late-night update that caused an unexpected bug, but because our two systems constantly communicate through open networks, it was resolved within just a few hours and likely went unnoticed by any user or attacker. These quick fixes can happen with any of the open APIs we use, such as Searis or BarentsWatch.

Essentially, Manolin is constantly testing all of these systems, multiple times per day, as we pull data through our pipelines. This translates to a better chance of repairing a security vulnerability before a customer or attacker finds it. Collaboration lowers risk.

As malware tactics become more sophisticated, companies’ internal defenses have to keep up. Building systems that are frequently—or even better, automatically—scanned for vulnerabilities is a great way to strengthen a company’s defense.

Data sharing benefits all
The ocean is already a complex, volatile system. Aquaculture software deals with one of the harshest environments in the world: It’s easier to transfer data from space to Earth than underwater to land.

Data sharing not only leads to better data security but helps build tools that benefit the entire industry. Pooling information on the conditions and factors driving fish health issues, for example, can build powerful forecasting models that give more accurate insights. By anonymizing data, this also comes at no risk to data privacy.

In order to continue feeding the world healthy, sustainably raised salmon, the aquaculture industry needs to innovate and collaborate with open technology. As is always the case in this industry, we become stronger by working together.

For more data on the state of Norwegian salmon farming, subscribe to Manolin’s newsletter.