On Sunday night, staff at hundreds of French supermarkets arrived at work to find the freezers warm, the food spoiled and, in a few stores, equipment that had overheated so badly it had started to burn. Nobody had broken in. The attackers had logged into the systems that control the fridges and told them to defrost, at around 50°C, for hours.
It sounds like the plot of a slightly silly film. It’s also a really useful reminder that “cyber security” isn’t only about laptops and email.
It’s not just computers any more
Think about everything in your building that is plugged in and can be controlled from somewhere else. The heating and air conditioning. The CCTV. The door entry system. The alarm panel. The fridges in the staff kitchen or, if you run a café, shop or care home, the ones your business depends on.
A lot of this equipment is connected to the internet so that the company that installed it can check on it, change settings or fix faults without sending an engineer out. That’s handy, and it saves money. The catch is that if the installer can reach it from the outside world, so can anyone else who finds a way in.
A few years ago, all of this came under the heading of the “Internet of Things”. You could hardly open a newspaper without someone predicting fridges that would order their own milk. I’m quite glad the phrase has faded, but something went with it. Once connected devices stopped being new and exciting, we stopped talking about them, and they quietly became part of the furniture. The heating controller, the door entry panel and the fridge in the back room are all still online, whether anyone is thinking about them or not.
The business version of this is usually called operational technology, or OT. You don’t need to remember either term; you just need to know it’s there.
Why it gets forgotten
Most of us know our laptops need updates, and they nag us until we install them. A fridge controller or a door entry panel doesn’t nag anyone. It sits in a cupboard doing its job for ten or fifteen years, and nobody thinks about it until it goes wrong.
That’s part of what happened in France. The manufacturer, Danfoss, has said that most of the affected equipment was older kit that no longer receives security updates, and that it had been encouraging customers to replace it for some time. Nobody had a reason to look at it, because it was still keeping things cold.
Five checks you can do this week
You don’t need to be technical to make a real difference here. Start with these.
1. Make a list. Walk round your building and write down everything that’s “smart”, connected or managed by an outside company. Heating, alarms, cameras, door entry, fridges and freezers, even the coffee machine. You can’t look after something you don’t know you have.
2. Ask who can get in remotely. For each item, find out whether a contractor can access it from outside, and how. It should be limited to people who need it, using their own logins, ideally only when you have agreed to it.
3. Check it’s still supported. Ask your supplier whether the equipment still gets software and security updates, and when it last had one. If the answer is “it’s out of support”, that’s the moment to start planning a replacement, not after something goes wrong.
4. Change the default passwords. Plenty of equipment arrives with a standard password that is printed in the manual and easy to find online. Make sure every device has its own password and that it’s been changed since installation.
5. Plan for it failing. Ask yourself what you would do if this piece of kit stopped working tonight. Who would notice, and how quickly? Who do you call? Is there a manual workaround? A few sentences written down now will save a lot of panic later.
Your supplier is part of your security
One of the clearest lessons from France is that the supermarkets didn’t write the faulty software. They bought equipment in good faith, and the weakness came with it. That’s normal, and it’s why it pays to ask your suppliers a few questions when you sign a maintenance contract, and again every year or so. A good supplier will be glad you asked.
Where to start
If you’d like your team to understand this kind of risk without drowning in jargon, our information security awareness training covers everyday threats in plain English, including the ones that don’t look like computers. It’s a good first step towards making sure your business isn’t caught out by the kit in the cupboard.
