Bites & Bytes Podcast
Food Industry Challenges: A Legal Perspective with Mike Delaney
Mon, 11 Nov 2024
In this episode of the Bites and Bytes Podcast, host Kristin Demoranville welcomes her good friend and former colleague, Mike Delaney, a seasoned corporate lawyer and partner with expertise in complex legal matters across industries. With over two decades of experience, Mike has held leadership roles at multinational corporations, where he managed global compliance, risk, and corporate governance. Kristin and Mike explore the real-world challenges in food cybersecurity, sharing stories from their work together and discussing how industries like food manufacturing and supply chains adapt to meet today’s cybersecurity threats. From legal and compliance perspectives to human and technological considerations, this episode contains practical insights and firsthand experiences. _______________________________________________ Show Notes: DISARM Framework: https://www.disarm.foundation/framework Beekeeper movie: https://www.imdb.com/title/tt15314262/ SEC Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies: https://www.sec.gov/newsroom/press-releases/2023-139 Form 8-K: https://www.sec.gov/files/form8-k.pdf _______________________________________________ Episode Key Highlights: (0:00:00) - Food Memories and Personal Connections (0:06:50) - Industry’s Push for Modernization in Cybersecurity (0:21:00) - Key Supply Chain Vulnerabilities in Food (0:31:28) - SEC’s New Cybersecurity Reporting Rules (0:43:00) - Rising Cyber Threats Targeting Food Sector _______________________________________________ Bsides ICS/OT Conference 🎉🌟 Feb. 10, 2025 in Tampa, Florida 🌴 (day before S4x25 Conference) 🔗 https://www.bsidesics.org/ Call for Papers is OPEN till 12/31/24! Registration is OPEN: https://www.eventbrite.com/e/bsides-icsot-tickets-1078099778459 General Admission is $30 and Student/Veteran is $20! Questions or Need more information email [email protected] _______________________________________________ Bites and Bytes Podcast Info: TikTok Website: Explore all our episodes, articles, and more on our official website. Visit Now Merch Shop: Show your support with some awesome Bites and Bytes gear! 🧢👕 Shop Now Blog: Stay updated with the latest insights and stories from the world of cybersecurity in the food industry. Read Our Blog Audience Survey: We value your feedback! Help us make the podcast even better. Take the Survey Schedule a Call with Kristin: Want to share your thoughts? Schedule a meeting with Kristin! Schedule Now
Welcome to the Bites and Bites podcast. I'm your host, Krista DeMoranville. And today I'm excited to have a special guest and also a good friend, Mike Delaney.
Mike is a seasoned corporate lawyer and a trusted ally in cybersecurity. Together, we'll tackle some challenges in the food industry. We'll share some insights from our experiences working together, discuss the risk and strategies for securing the food supply chain. Let's jump in. Hi, Mike. Thanks for being here with all of us.
I am going to jump straight into favorite food and favorite food memory, and then we'll go introductions. So go for it.
My favorite food at the moment, I think this actually spurs from a very jealous thought. My son right now is actually studying down in Australia and planning a trip to backpack through Southeast Asia. And we've been looking at all the different options that Thailand call. It kind of set me down the Thai path. Just this week, I made a Thai curry at home. So I'm kind of in that Thai curry.
That's great.
I have curry at least once a week, but mine's Indian. So that Thai curry is excellent. When you have it in Thailand, it's entirely different, by the way.
Yeah, I know. Mine was homemade at home. So I'm sure that my son will have a little bit better than me. And your favorite food memory? You know, there are so many. I mean, food really, you know, is one of those things that brings us all together. But like from my perspective, it's a picture, but we were in Austria. I took my kids to Austria one winter. We went to Munich and to Innsbruck skiing.
And we were sitting in Innsbruck at an outdoor local Austrian place overlooking the river Innsbruck. And it was just one of those family moments where you're just brought together around really good food. We're eating local Tyrolean specialties. And it was just, it was one of those once in a life kind of situations. You know, there are probably lots of those food just as always.
It almost brings the memory alive. If you have it again, like I remember that together here. So that was one of my favorite memories.
I think that works too with flavors, different flavors. Like if I have licorice, it makes me think of my grandfather because he was Swedish, especially if it's black licorice. And certain smells of coffee, certain types of coffee gets me with some people. And then obviously different other smells like baked goods. And it just triggers that memory.
And I think that's part of what makes food so special is how food is memory.
It's memories, good and bad. But like, you know, I have a favorite type of wine. I like a Sauvignon Blanc. Yeah. Not that I really have affinity for it, but I had it for the first time, like a good bottle anyway, in my adult memory when I was on a trip to Auckland for business.
And I was sitting in a harbor restaurant overlooking the water and we had Sauvignon Blanc from Marlborough, New Zealand and forever. That's the kind I have to drink. And when I drink it, I think about those amazing views that I saw.
Not to mention that's a great place to get that wine because it's like their wine. Like that's brilliant. I'm not so much a Sauvignon Blanc drinker because it can lean on banana forward and I'm allergic to bananas. So, and if I get a whiff of that, I get all weirded out. But if there's ones that are like pineapple forward or like guava forward, I'm fine with those.
But yeah, that's, that's amazing. Both those memories are great. I can actually almost visualize the skiing one too. It was, I could just see that. That was great. Yeah. Thanks for showing.
I didn't jackets, but I had little heaters and it was just as well as coconut.
I love how that part of the world just keeps on going, even when it's cold. Like, they don't care. They're like, put a heater up, light a fire. A lot could be said for some restaurants to continue keeping their outdoor seating in the winter and autumn timeframes. Thanks for that, Mike. Do you want to introduce yourself?
Yeah, sure. So, you know, actually, Kristen and I know each other from a number of years working together when I was the chief legal officer at CSM Bakery Solutions. It's there that we actually dealt a lot of cyber security issues together. Currently, I'm actually a partner with a law firm called Zapoth Shaw in the Atlanta office.
Just about anything that I can get my hands on, but I'm a corporate lawyer. And so, you know, contracts and triage too, I think is a lot of what I do.
Maybe a little therapy as well.
Sometimes I'm the therapist. Sometimes I'm the one who meets the therapy. So while I was at CSM, I dealt with risk management, adults, legal, HR, worked with Kristen directly on some cybersecurity matters for a bit. Prior to arriving at CSM in 14, I was the general counsel of two different logistics companies, one in the food business called AmeriCold, a big tech or digital warehousing business.
And then another, which was outside of food, that was more focused on service parts. It was Caterpillar, a Spubloff entity. And began my career practicing law at a law firm. So I did that for about 14, 15 years. Sold myself out of a job, and we sold CSM. So here I am back in the law practice. I'm actually having fun. Good avenues for me to be in and out.
probably more of a work-life balance for you too because i feel like sometimes things just got wild 24 by 7 in a food production company yeah we you know as as uh one of our colleagues and i used to say all the time there's never a dull day at the bakery we don't know it's okay let's go and a lot unfortunately in the computer cyber security background
Yeah, there was a lot going on. But there's still some good people that are helping out whatever that company looks like now. I do know that. And I still consider it one of my formal years and my profession, really getting to know that side of the house. And also, I was so exposed to the executive side. I mean, I was with you guys all the time.
And on top of being on the factory floor, dealing with whatever was going on there, I think that gave me some really interesting insight on the inner workings of how a food company works. and expectations and even some of the ramifications. I remember just sitting in your office, Mike, and we would just be rifting about this bad stuff. What's this do? What's going to happen now?
That kind of thing. Or you would be educating me on the best course of action for what's going to happen with whatever's happening. And I should let everyone know too that Mike actually was the one that pulled me into my first crisis room for my first official breach that happened at a company. So that was... It was a good Friday. And I remember that was a long weekend we were supposed to have.
And everybody checked out at, what, 2 o'clock that afternoon normally out of the corporate office. And nope, you and I were stuck there until I don't know what time. And thankfully, that was an easy breach. And I have quotations up. Nobody can see. It wasn't ultimately the worst thing in the world. It just kind of stunk for the people who were involved.
But yeah, you never forget your first breach, Mike. Yeah, totally.
Well, you know, and if you really think about our experience together at CES and what we're doing and our roles and what other people were doing, we were transforming that business.
Yeah.
And if you look at kind of the position of where the food industry is kind of in the... The kind of adoption of IT and the adoption of the dependency on IT, it is, and it's documented that it's, you know, it's behind a lot of other industries. It is a much more traditional, much more stuck in custom, stuck in old practices.
And it has only really recently begun, but for maybe some really large companies to accelerate into the IT world. And one of the things that you and I did there and went without... catastrophes to go along with it. We were part of a team that took a mishmash of computer systems and were forced to, with our thesis, to put them into one platform. A lot of the companies aren't even there yet.
But then, and we'll talk further about it, but once you get those platforms running, those ERPs, and they start plugging in all of these places where I know you start to cringe with the vulnerabilities from IoT and Yeah. Monitoring devices. And I think that's where this push to modernize the food system, which is a necessity, is really, it's a two, it's got two sides to the sword.
We have, you know, the necessity, the efficiencies and the cost drivers and everything else. Every time you do these
as you increase vulnerabilities in the cyber world and that's that's the world that i think we're going to be continuing to drive through but that'll be where i think food in itself continues to struggle is it's growing into the technology but yet it is not ready for the challenges that come with it and those bad actors that want to do naughty things so
Well said. I think also too, there's been so many incidences that I can pick off the top of my head about, you know, the companies are gone digital. They've got all these digital processes. That's great. Things are running and then they get hacked and now they're screwed because they don't have a good proper business continuity plan. They don't have a good disaster recovery. It's a mess.
And then they have to move to analog. And we kind of experienced some of that when we were doing, as you mentioned, the ERP system upgrade, we were struggling with it. It had to go on paper. We had trucks waiting. It was a mess. I want to say, I want to go on record again, saying that my factory that I was at for that whole launch of disaster was the only one to get trucks out that day.
You're all welcome. Because we got it out on paper because we rolled back to analog processes. I still think there's a place for that as a disaster recovery moment. And I'm glad that we followed it that way. But a lot of places are finding they can't roll back that anymore. They can't go back to paper. Nobody knows how to do it because legacy knowledge was lost.
And this is why people in process, especially learning that and back in the bakery days was you do something, they're going to take it apart or they're going to circumvent it or they're going to do whatever they want. I remember I was standing in one of our factories in Buffalo. I will never forget. I was walking through the warehouse and it was it was full. It was towards the holiday season. And
There was a scissor lift in the middle of one of the aisles and I kind of like poked my head around and I was like, what's going on? Maintenance manager was up there unhooking one of the access points to move it back 10 feet because nobody did a Wi-Fi heat map scan to find out that the Wi-Fi wouldn't go through bags of flour.
And I sat there and I was like, who would have ever thought the Wi-Fi wouldn't go through bags of flour? That seems absurd. Like, why are we having this conversation? But that's the kind of stuff that the food industry is dealing with on a daily basis. Yeah. They lose access. They can't work. They can't pick orders. They can't get the ingredients delivered to production. They can't keep moving.
So, of course, naturally, they would circumvent any of my security controls and just go do whatever they wanted. Because we didn't have IT on some of these sites, and this is very common, we were discussing this before we started recording. There's not enough people or personnel to be that SME or be that person in that role on site at all times. And because of that, somebody...
makes themselves the official IT security person and then does things without blessing and potentially becomes an insider threat. I saw that time and time again at any factory I've ever stepped into. It didn't matter if it was food or not. There was always a few people that just took it upon themselves to circumvent controls because it was halting production and safety.
If it's those two things are interrupted, they don't want it.
Well, in my experience, I mean, and this is not a cyber issue, but I experienced circumventing safety, my role prior to joining CSM.
And we had fatalities resulting from the avoidance or the safety rules because they were viewed as a hindrance to the operation, getting things done. So they did. They had these workarounds and things like that. stuff.
And where I get worried about when we start continuing to enhance and get more dependent upon computer systems and our technology, if you recall, the whole point of putting in our ERP system was order to cash, right? So it lived the whole life cycle of product.
Now, you may have opportunities where individuals can go in and do things like you mentioned, moving access points, data points, Wi-Fi points. But then there's also the other risk where it's inflexible and you're not able to do a And when someone makes an intrusion into your system and messes up your supply delivery to your manufacturing and it seizes up and stops, right?
Or if you think about what we experienced when we flipped the switch turning on our ERP system, it wasn't ready yet.
and where we really saw issues was warehouse and rigid nature of the computer system was like I need you to pick that pallet out oh yeah I realize it's 10 pallets behind the other ones but move all those and get that one even though they're all identical because that's the one that I know has the right numbers on it and if you you can just speculate all kinds of different ways bad actors infiltrate your system and it was chaos that isn't even putting someone in danger or anything else just simply messing it up just chaos just chaos agents yeah fixing chaos
itself, it takes so much time and money and it could put a company into bankruptcy if you can't deliver your products. So it's filled with risk.
There's so much and we're not even touching like the food safety aspect, because if you got that component in it, then if you have chaos and a food safety problem or potential food safety problem, whether it's contamination or any kind of adulteration on the line or any of that other stuff, then you got a catastrophe happening.
We narrowly avoided some of those, but I think we also went through some of those. And I'm not saying like there was food safety issues necessarily. I'm just saying like every day presented a new set of things. And there was always some type of, as you said, fun times at the bakery, you know, in general. And And people think that this doesn't happen.
Well, but you think about it, like, you know, if you put, pick a name brand company on Laura's Coles, because I know they had a breach. Yeah. And that's a company that people will recognize and say, yeah, I could see why they would attack a massive beer distributing company or, you know, brewery because, you know, they're billions of dollars. They have notoriety.
You can extort them because they're worried about brand reputation. Of course. You take our little bakery company, no one's ever heard of it. Now, you and I both know that folks probably eat our food at least once a week, you know, when we were there once a week, because we supplied all of the major goodie shops that, you know.
All those favorite rolls at all those favorite restaurants.
Donuts and everything else. So, but our company was not well known, but yet we had a fair share of people attacking us. We went from infiltration where we had people behaving as if, you know, the false presidents, you know, our CEO maybe spoofed her IM capacity in the firm. She would send chats to people
Like in a very casual way, you know, emails are always, you've seen that and we can talk about it.
She got hit. She also got hit with a, she got connected to a pineapple in an airport. And for those who don't know what a pineapple is, it's a spoofed access point for wifi and you can connect to it. I think you're connected to the airport wifi, but you're not. This is why you need a VPN, by the way, if you're going to do that.
Yeah, she connected and they, they ripped off her active directory, username and password. They locked her out every five, six minutes. They were infiltrating her email. It only lasted like a couple hours, but we kept saying, you need to change your ID. It took a while for her to understand why, because that's not her world. She just wants it to work.
Think about who we were. We were not a brand name that consumers recognized.
But we supplied the ones that people did recognize. And that's why people need to realize the supply chain attacks don't go after the big players. They go after the small to medium players.
One of the reports I was reading talking about, you know, kind of the state of play in 2023 and 24 pinpointed that exact issue was a lot of folks don't understand how complex the supply chain is in the food industry. They don't, because you don't see it. If you are a consumer, you buy your food at the grocery store. How it arrived there, where it came from is really not that relevant.
You know, you're rushing through, your kids are crying in the car, you're just trying to get home and make dinner. And you don't really think about where the frozen food, you know, not understanding there's a number of warehouses around there. Every major metropolitan area warehousing, you know, multiple days worth of food because it's almost just-in-time inventory at some level.
And those organizations have been breached. My former employer was breached more than once to the point where it took them offline for well over a month. They had to go analog as well. They had basically pushed all of their employees in the main office out to their homes because they could at least regulate access there. But they were merely warehousing and transportation.
They didn't produce, but they managed. they were right in the middle of whether or not you're going to get your food at the end.
Yeah. And it's just chaos. It causes chaos because disruption is actually, I think, sometimes worse than the financial ransomware. Just the straight up, give me your money or I won't give you your stuff back.
Well, statistically, at least in recent year, the ransomware attacks are probably like 70% of what people are seeing. And I think that that quick buck kind of, you know, those bad actors, they're criminals. And before we started recording, you and I were talking about, you know, one of my bigger fears now isn't so much the bad guys.
There are always going to be a state of play that we're going to have to worry about. There'll probably be a point where we can even ensure for it better than kind of we are doing now. There are solutions or at least ways to mitigate. Where I'm getting more concerned is when food security becomes part of a Cold War effort or a World War. Yeah.
You have, you know, a bad actor state, let's pick on Russia, because we know they're quite active, you know, politically, right? I mean, if you want to go, you know, read blogs, nine out of ten of the responses are a Russian bot.
If they took advantage of the vulnerabilities of our food supply chain to not even do anything, you know, super nefarious, like, you know, poison or whatever, just mess it up. And then start a information campaign to... I really think that that is where we're going to see a lot because the Internet, unfortunately, people think a lot of it's true. Right on the Internet must be true.
Yeah.
So I'm really worried that that might be an area where we start to see. And we're not all on board with that viewpoint yet. And we still have a lot of friction in the business community about it.
Another example of an attempt to approach this and regulate it, and I think it was 23, the EPA or 22 had come out and put some mandates on, or at least some effort to prescript an approach to dealing with water security. And then the Eighth Circuit basically put a hold on it. And they said, no, we think you're overstepping.
And then the EPA is just like, you know, grabbing his head going, what are you talking about? This is happening now. And that's what I said, like the law is going to always lack. Where it's going to be dealt with is in the trenches. It's when you're called in because there's a breach or you're called in, like how do we handle the legal side or the risk side of it?
But the date is going to be much slower.
Yeah, the water situation is quite frustrating. I have some professional friends in the water sector, and they're just shaking their heads at this point. However, I do think that there'll be cybersecurity regulations in water within the next, I don't know, two to four years, depending on what happens with our political situation.
But if water goes, then the food industry and agriculture will go next, in theory. So I'm here for it. Let's bring it on. But I want it to be proper and well peer reviewed and well constructed. I don't want to just have a simulated exercise every three years. That's not good enough. That is certainly not good enough.
Bye.
Quick announcement, everyone.
If you're interested in ICSOT cybersecurity, whether you're a student, an industry newcomer, or a seasoned pro, B-Sides ICSOT is the place to be. Join us on February 10th in Tampa, Florida for a day packed with practical learning, real connections, and insights into securing critical infrastructure. This event is designed for everyone, no matter where you are in your career.
B-Sides events are known for bringing people together, and this is the first B-Sides focused on ICS OT security. And for all the women in OT and ICS cybersecurity, don't miss the women in ICS cybersecurity reception that evening. Ready to be part of something impactful? Visit bsidesics.org for tickets, speaking opportunities, and more.
Also, if you were planning on attending S4 in Tampa, it's the day before. Check out the website, and hopefully I'll see you there. I'm really glad you hit on the disinformation, misinformation kind of conversation, because this is something that is an active part of cyber warfare. I do have a tip for everybody.
I do know one of the co-founders of Disarm, which is a framework that helps deal with this. And it's great. If you get a chance to look at it, I'll put in the show notes.
But one of the things that was said recently to me about this was, if something you read on the internet causes you to have an emotional reaction, you need to distrust it immediately, whether it's positive or negative, because that means that it's more than likely you are being influenced in some regard. Mm-hmm. And we need to stop that.
But we have to start looking at things differently because we're in a different world now. We can't just go down to our neighbor and get a recipe for brownies. We just go on the Internet. Right. But should we trust that particular recipe? Maybe they put too many eggs in it. Then you have more of a cake like that's not going to work. Or maybe it does. Maybe that's what you want.
So I think because we've lost community and a trusted community, now we kind of have to rebuild what that looks like for us.
so i'm glad you brought that up because i think that's something that i feel that the food industry as a whole is going to have to deal with really heavily especially since you have consumers involved you have opinions involved all this tracking now traceability is a huge thing in the food industry huge now what does that mean for data where is that going who's protecting it how much are we tracking the consumer is the consumer going to be able to follow the seed that made their bread all the way through the chain is that something we're going to give them access to i mean that's
you know and and and the question i have and then you know ed i'll defer to those that are much more savvy in technology but you know there's been discussion about you know relying on blockchain those sorts of technologies to help map you know forward to table kind of process yeah you know and and And I think the belief is that blockchain is somehow infallible, which I don't think is true.
But you have the risk that creating, and we need, because I think it's important to know where your food comes from. Traceability paradigm creates a dilemma because that is yet another point where they can intrude and insert, use our chaos, where they can change the facts that are in traceability path. And then that's where you start then to build on the other side of it, the misinformation.
You know, you can create chaos. You can create a panic at a very basic level. Particularly if you did it during a point where maybe everyone's on a heightened level of panic, right? What if somebody did that during the COVID pandemic? Right. Well, we're all paranoid about everything anyway. And now all of a sudden someone came in and attacked our food chain.
And we can't even trust, you know, where our fruit's coming from at the moment because it's a real challenge we have. And it is a, well, I know you've been in this sector for quite a while. For the common person, this is a newer, newer, you know, reality.
This is, you know, now we've seen, you know, I think we all now have the pleasure of having our social security numbers now hacked and distributed. But it's impacting people on a much more routine basis, right? Yeah. In your basic email, you're probably getting spoof emails from, you know, the various scams out there all the time. And God forbid you click on one.
But, you know, UPS wants to tell me desperately about this package that's sitting in the warehouse that I, you know, I must click on the link to get the information. You know, if that email doesn't come five times a day, it's not coming. So the fact is, is we're all vulnerable to this. Yeah.
These hackers are, you know, they're testing everywhere they can and they're pushing into every sector, every business. My prior law firm had an infiltration and we had a number of clients have data access issues as a result. That's not good. It's not. And one of the largest food manufacturers out there was a client had 50,000 of their employee records were accessed.
I could pierce through the law firm to get to it. And so, you know, and obviously in the law firm, to their credit, we had lots of training. We had lots and lots of cyber training. And we talked about phishing. They would do, they would come in and get an email and it would be like, you know, Hey, Mike, here's a document we need to continue to work on.
You know, you can click this link to get access to the data shield site. And I sent it to the IT guys. I'm like, I don't think this is real. They're like, ah, congratulations. You figured out our little trick of the day, you know, because they did test us. It's a constant. And so food manufacturers are going to face it. And it's not just their own systems. There's attacks from all different angles.
Like we talked about, it could be the manufacturers making donuts. They're fine. Put it on the truck and that trucking company has a problem. It is a complex web we have to supply food to our country. And we initially came out and food security was not focused on cybersecurity or even protecting the food itself. But more food security was the security of knowing your next meal is going to pay.
Yep.
You know, the inner cities or rural communities that don't have a lot of access to food, they have a family dollar or that's it. You know, they have food insecurity. So that was where our mind was a decade ago. Food insecurity was getting food.
Now, food security is not just getting food, it's making sure the food is edible, it's safe, and that once it's gone off the shelf, the truck's going to come and fill it again. And, you know, so getting more complex. And I think technology, as much as it's supposed to make our lives easier, and it will, but it also makes it more complex, at least for folks who deal with IT problems. Exactly.
Yeah. And I think I forget sometimes the lack of knowledge that people have how cyber attacks happen or what they actually where they're coming from. I feel like people read the news and or I think they listen to the news. So I would assume they kind of know where it comes from. But then it dawns on me they don't really do it justice.
Well, before we get on the call, you mentioned that these are all shell companies. They have their own marketing teams and their HR teams and they act like a normal corporate environment. But they're a hacker gang, you know, and some of those people are forced to work there because extortion and other things. It is it's not just the hacker and the hoodie any longer. It's the.
They got they got brand names. They got Lockbit and Black Cat. Yeah. The FBI now is worried about one called Snatch. I don't know if that's the hit movie or what.
I don't know. I just I find it to be really interesting. I don't know if you've seen the movie The Beekeeper yet, Jason Stamos' new one. It's actually all about what happens when a scam artist and some hackers get in and steal money from an older woman and what he does to them. I feel like it's a victory movie for all of us who work in the industry. However, it is quite violent.
But I do feel like it's an important movie for people to watch if you can stomach violence to understand the extreme lengths that they go to to get your money and how they scam people, especially the elderly. And as a human being, it's just so frustrating that humans are so awful to each other.
know like it's this is absurd but this has been happening on every level since the dawn of time extortion happens and this is just a new way of doing it but it's it's exactly and it's in it's in real time for us because we're seeing it thanks internet and it's hard so i think a lot of it comes down to awareness so i appreciated that you had an awareness moment with me because and then reminding me that i need to be more proactive in explaining it to people yeah
People live in their own experiences and whatnot. And if you segregate IT knowledge by generation too, you know, you compared me to my children. My children were much more savvy. When my kids first wanted cell phones, I would tell them they can get it the same age I got my first phone. It is well after college because they weren't invented yet.
But you look at my parents and while I find them quite savvy for their age, they certainly have more trust than I would give the Internet. And I think that, you know, that's another aspect of it, that people don't quite understand how easy it is to behave badly through the Internet and information technology and how quick you can be bad.
I have to say, I'm grateful that my parents actually text me or send me a screenshot of something they get and ask me if it's legit. And I'm always like, no, delete it. This is my whole thing. If it's really important, they will get back to you. If you delete something, they will get back to you. It does.
I've said this, I think my whole career, I even probably said it to you four or five times, Mike, just delete it. If you don't know what it is, they'll get back to you or they'll call you, you know? I just wanted to quickly give you a moment to talk about your role as a corporate lawyer in a food company. A lot of people don't know what that means.
They think lawyer and they picture maybe a courtroom or they picture paperwork or something like that, but sort of like a day-to-day in a food company that you would deal with as much as you could probably disclose. Just a quick snapshot of what that looks like.
Yeah. So I'm certainly not a law talking guy. I don't go to court. That's not what I did. Sometimes the day was mundane. Sometimes it's negotiating a supply agreement with your flower distributor. That's going to be a multi-year agreement for millions of dollars and it would take months and months to negotiate. Sometimes it was dealing with an unfortunate accident or incident in a facility.
We're dealing with one, the safety and health of our employees. One two, dealing with what happened, why and Is this an OSHA issue? Do we need to report it? Those sorts of things. When it came down to the cybersecurity side, you know, it ranged from the early days of, you know, when we learned of an incident forming that task force to get in the room and figure out what's going on.
I think food in general is advancing because now we're looking at more robust recovery plans. I think cybersecurity is now finding its way into there. You know, but we would focus on that, you know, Sometimes it was, you know, I had the board of directors coming and I had to go deal with them. And they played a role in cybersecurity because, you know, again, it's an issue that popped up.
It was front of mind for our last company because we were doing such a large revision to the IT infrastructure. So the board was very much involved in that and listening and learning and watching it. When we did enterprise risk management assessments, IT was always top of mind and usually one of the higher risks we had. Yeah.
As we implemented our system and eventually worked through the bumps and issues that we had, especially it ran fine. Our risk assessment moved. And that was one of my roles was a risk manager. I worked with our risk manager. We would do this assessment every year with the board. It moved from. the system itself running to worrying about the issues that could come in and it haunts.
And the board often look towards insurance and you and I and past have talked about whether or not insurance is a good way to go. I have a lot of faith in the insurance business. I think they're usually ahead of the game in terms of pricing risk, seeing risk. IT, I think they struggle with. Cyber is even worse. It is an area, again, it's a new issue.
It's not that it's been around that long, at least in its form. And so I think they're trying to create products that aren't necessarily caught up to the issues yet.
Yeah, and they don't know how to underwrite for it just yet either. There's not enough cybersecurity expertise or IT expertise in the industry. It's getting better, but it's not quite there yet.
No. And again, before we got on, we were talking about a lot of Western world IT cybersecurity management is reactionary. We've seen incidents occur. And one of the bigger ones in the recent years was when JBS had its ransomware attack. And that one really rippled through the industry and raised awareness to this problem. But it certainly wasn't the only incident.
160 food companies last year alone that had some sort of attack. That we know of. Let's actually, and I want to segue into that because one of the things about cybersecurity and the risks that go along with it is if an event happens, if it's material enough, it can really, really hurt your reputation.
It can hurt your bottom line, which usually if your reputation's hurt your bottom line, it's going to follow quickly. So getting information out to the marketplace is important. However, when you're dealing with private management team, they might not want to get that out.
And if they can contain, control it, they'll prefer not to let anybody other than their board know what they just went through. That's changed in the public company world. Starting in December of last year,
The SEC added another reporting requirement to companies that are publicly traded, and this applies to a lot of food companies, that if they have a cyber incident happen, they have a responsibility to report that to the investment community in a prompt manner. There's all kinds of nuances to it. It's called a Form 8K, and the Form 8K is really just a current report.
And there's a list of many different activities that happen that companies have to routinely report out to shareholders. And the rationale is it's information that should be out on the street so they can make an assessment of their investment. And the SEC is, you know, share it with everybody. It's fair. Yeah. When it comes to cyber, they decided to add it as one of the disclosure item 105.
It's if you have a cyber incident that you determine is material to your company, you are required to report it to the shareholders and to the investment community at large. The problem is, when do you know that it's material? And there have been incidents, and the example would be my prior law firm, when they had the infiltration and this large food manufacturer had its issue.
And this is all public, by the way, I'm not using names, but it's public information. When that happened, it took them months to kind of figure out and get their arms around how far these folks had infiltrated the information that they accessed. Of course. So whether it was material or not was not something they could decide.
The SEC, because this is important information that's happening in real time, told companies, you need to report this within four business days of making determination that it's material. Companies have played that going, well, I don't know if it's material yet, so I'm not going to say anything. Well, the SEC hasn't really been keen on that.
It's like, no, the whole point was to let people know you had a problem.
Yeah.
You think it's going to be material. So they've worked around that a little bit. And they said to companies that, hey, if you don't know if it's material, our advice is report it. And there's a way under the SEC filing structure that you can report it and not have liability.
So you can come out and say, hey, guys, I don't know if this is going to be what it is yet, but we're going to let you know we had this infiltration. We're currently assessing it. If we deem it to be material, we will let you know. So that's one way that they've done it. But again, the whole point is information of these events is not necessarily always available.
Public company world, it's becoming more available because the SEC got involved. There is an exception to that I mentioned to you earlier before we got on the call, that there are exceptions if the DOJ or FBI are involved. And as you know, when an event happens, oftentimes they're one of the first few to get a call if it's bad enough.
And then they have an interest in maybe coming to a public company and saying, hey, hold your horses. Don't let the cat out of the bag on this yet. We have a lead. We don't want to scare it away or have them cover their tracks out there in the internet world. Or B, this is actually a bigger issue than just you. This is a national security problem. They've attacked multiple manufacturers at once.
Don't say anything. And then there's an exception that you can work through. All of it requires you working with your attorney and everything else. But
That's why it's important to report too, so they can have that evidence to gather to catch the bad guy or gal.
And again, that goes back to that balancing that desire not to go and cause a reputational problem and maybe buckling up your big boy pants and saying, if you have a problem, we just got to fess up and let's just deal with it. You know what? They're happening all over the place anyway. You're not the only one.
I always say it's a running joke in the industry that if you haven't been hacked, you're not a legit company. And I say that in jest, but it's true.
I mean, looking at the numbers, I would bear it to say that just about everybody has somebody trying to attack them.
Yeah, but it's about the larger problem. It's how many times has this particular bad actor been causing these problems? Because I don't think a lot of people realize that when one hack is happening, it's actually several that have been released. It's not just we punched your one company because you're the most special one out there. No, they like scatter spray at the same time.
So it's more than one. And the FBI needs that information because they're going to go catch the bad guy. That's what they're going to do. That's what the FBI does. They're not going to fix the problem. They're not going to do anything for you. They're just going to say, thanks for the information. Give me all of that information and I'm going to go do my job.
And I think it's important for people to know that you're helping the community by doing that aspect. It's not about shame. They don't care. They just want to get the information and get out as much as they don't want you to have them there either. And I think that the information sharing issue is such a huge problem
You could still talk about this like you and I are talking about it in a way that's you're not tipping off which company it is. But you could talk about, OK, I have this problem. You know, you know what kind of industry I'm in. But, you know, like, what do I do?
And I think it's super important that people look at scenarios and they do these exercises in the planning and then they come up with playbooks. What's going to happen? How are we going to get through this moment? I have so many times I've had the food industry say to me, what happens if I I'm in a cyber attack?
how will i know you'll know like you just know there's something about it it's sort of like you know when an earthquake's happening you just kind of know what's happening instinct sort of kicks in somehow but what do you do after that effect like that knowledge where's your stop drop and roll right that's the disconnect that's the disconnect i'm in right now with a lot of people is okay yep we've got a problem but chaos here i don't know what to do i don't know how to sort the chaos and
I feel like it's a responsibility of certain individuals inside these organizations, whether it's the corporate lawyer, certainly should be the security team to kind of cut through the noise and say, okay, here's the things we need to do right now. Ground zero. Let's do this. Instead of everybody's running around like inflatable two people, which I feel like happens quite often.
And I think people sharing that information and maybe even some of that burden and struggle of, hey, I had this happen last year. Did you guys have anything like that happen in your social professional circles should be done more often. But there should be more conversation around what the incident was, what they try to go after, how did they get in, those kind of things. So people can fortify.
You don't want this to happen to everybody.
You know, and again, I think as it becomes more and more important as part of kind of, you know, the hazard assessment process, the push to include cyber as part of the recovery disaster planning. Yes. Having a framework, you know, like kind of, you know, in food, an example of having a framework is most food manufacturers have a program in place for recalls, right? Uh-huh.
We have a contaminated food that's left our factory. What are we going to do? How are we going to make sure that it doesn't go inside a consumer's mouth and make it hurt? I mean, really today, the overarching problem here, we could look at bottom lines and all that stuff. The matter is, is food and medicine are probably the two things created that people ingest catastrophic consequences.
Not even if it's like the Tylenol pills from the 80s. It could be peanut in your flour.
Peanut dust. Yes. Peanut dust is in everything.
Yes. child who has an allergy could eat and it could be a fatal event yep i as the executive of the food company would never have wanted that on my shoulders um ever so you know the the and i would i would extrapolate that out maybe there's one greedy guy out there but the truth is no leader no executive no employee of a company would want to see their product have that consequence
So, you know, but it's planning for it. It's worrying about it. So, you know, if you take that protocol we do for recall, we need to have this kind of protocol in place. And as they increasingly become a risk, we need to have it more prevalent, more important.
front and center because as we evolve, you know, the ERP system that we put in place and you start connecting the IoT devices to it, more vulnerabilities, you start automating processes where your whole system is automated, where the ingredients are getting included into the batch without no manual intervention.
All of these places are points where somebody can come in and do something you don't want them to do.
I've seen it done in labs. I've seen it done in labs. I'm sure every OT, ICS specialist is listening to this right now. I'll go, yep, we know we've seen those in our labs before. Everything keeps moving and the green light's still on, yet it's been messed.
And as we progress further into our embracing artificial intelligence. Yep. Food is behind on that. In fact, one of the statistics studies I was looking at, you know, there's probably about a third of the industry is just not even interested in taking it on. And part of it is because they're just not that sophisticated yet. You know, they're happy making grandma's old recipe cookies.
And why would they need the tech if it's working, right? It's fine. You know, the problem is, is that as we see the retail community continue to consolidate and continue to become a strong presence in the supply chain, they require the automation. They require the technology, the traceability. You know, sometimes it's automation for efficiency because they're trying prices.
I mean, you know, take Walmart, for example. They have missions, drive those prices down. Aldi, Lidl, all those competitors we see out there. Every little ounce you can shave off in cost or the little bit less you can do in the delivery process translates to the bottom line. So there's a... huge effort by these large retailers to scratch every efficiency they can into the mix.
Now, that's going to be where I think you see the continued push in the industry. But going back to the AI, when you start lending these technologies, and again, vulnerable points, really smart people who know computers better than I can find ways to get into these organizations through these different paths and reach absolute havoc. Yeah, it's scary. Or is it just malice?
I mean, sometimes it's just... Yeah, or is it nation state, you know? And just because... It's all going to be a bigger play as we go forward as well. It'll be part of that Cold War.
I do think we're going to see it in our lifetime. It's already here. We're just going to see it differently than we already do. I mean, Ukraine's been a great example of that. Well, not great, but as an example. What's been happening in Canada with the Russian gangs going after their dairy industries... quite interesting and watch the space, I guess, is what I say to that one.
The GPS being knocked out of the tractors during planting season just from solar flares is also going to make people go, I can mess with the ag industry.
If you think about it, you know, when the Russian military took over parts of the Ukraine, they took back equipment, you know, John Deere's and whatnot. And John Deere went in and locked down those computers. To be honest, it probably just delayed them a while before they broke it. Yeah.
Well, technically, you can hack a John Deere.
But the fact that you have now the ability of a manufacturer to transmit to the operating vehicle in the field and shut it down is just, again, another vulnerable point. And the examples continue, but that's the big risk I think we see is the continued evolution is going to be better for efficiency and for food production to grow and less resources to grow more, all that sort of stuff.
There's going to be continued vulnerabilities. And unfortunately, humans aren't all that nice to each other. No, we're all really jerks to each other. Another area that I read in one of the studies that was a really fascinating risk in cybersecurity with food is not necessarily in the manufacturing part, but go back to those fields where the food is being grown.
Again, we just talked about there is dependency already on technology. Absolutely. GPS-driven farming techniques and everything else. But also, you go back to the seed love, right? So, you know, when you're a farmer and you're planting, you have a window in your weather window to plant those seeds.
A month, three weeks, you know, depending on where you are in the world, when monsoons come, when rains come, don't come. Mm-hmm. Not hitting that planting season right could either hinder yields or cause the whole harvest to be scrapped. Yeah.
The fact that we have most of the seed technology, particularly in the U.S., but globally owned and copyrighted and patented by food manufacturers is a level issue because we can't get seed unless Monsanto makes it and issues it. And so if someone infiltrates Monsanto and screws up their system, we could have an entire soybean crop that doesn't get planted.
Yeah. People don't realize how interdependent all these companies are to the system. The system is not set up in a way that if you break the spoke on this side, the wheel's going to keep moving. That's not true. It's going to collapse. We just saw that with CrowdStrike as an example. It's an example now.
What could happen if someone figured out a vulnerability that was more generic?
Yeah, it's scary. And I think I have said this before on the show and I'll continue to say it, but GPS is important to planning because the machine will know exactly how far to drill down. how far to spread out the seed to make sure it's optimal cover to keep the weeds down and it's optimal watering, all these things.
And if it's not done in that way and it's precision farming, this is the way that the farming will be going eventually. There's a lot of resistance to it because farmers are about trust and we're not strong. So sure, we feel about tech yet in a lot of places. But these big factory farms will go full precision in order to get the highest yield the best way they can.
And they'll modify their crops and be able to handle higher temperatures and monsoon seasons and that kind of thing since our climate's changing too much. Even the cattle ranchers, they're developing slip jeans for the cows. So they can stand it.
The poultry industry is probably ahead of other parts of the industry.
They are and they aren't. So yeah, there is money. Absolutely. There's money everywhere.
But I will say, Mike, the conversations I've had recently with the meat side of the house, I think JBS really shook them up differently because it happened on their watch and their industry that I've had several conversations in the last month alone that they're worried about their supply chain and really worried about what they're going to do about it.
And my response back always is awareness is the first step. So what are we going to do after this? Don't try to boil the ocean, just make a cup of tea. You don't need to take on the whole system. There's no way you're gonna do that.
I want to take a moment to give a huge shout out and thank you to all of you who voted for the Bites and Bites podcast in the technology category of the Women in Podcasting Awards 2024.
We may not have taken home the trophy this year, but being nominated in our first year is an incredible honor. And it's all thanks to the listeners like you. If you haven't already, please make sure you like, share, and subscribe. Your support truly makes this podcast possible.
Thank you.
Now let's get back to the conversation with Mike. If you're talking about the grocery side, what can you guys do? You know, if you're talking about the actual ranchers, what are you doing? A lot of times ranchers don't have a lot of tech. Some of them do. It's not all like Yellowstone, right? They're not always flying helicopters. They're not always flying drones.
But sometimes their biggest equipment is the wheelbarrow that they take in and out of the barn. It just depends. I think we have to not oversell tech in places that doesn't need it yet. I think we need to button up what we've got out. and chaos. But I don't want people to think that it's all that all the time. It's not. Sometimes it's really fun.
Sometimes you're eating buttercream and like 10 a.m., you know, or you're eating a cookie. That's just the best part. You got the taste test. Yeah, I know. I mean, some of the some of the cookies were amazing. Some of the cakes were amazing. But I'll tell you, Mike, you're probably like me. You can't you can't unsmell that particular frosting and you can't unsmell that cake.
I walk into a grocery store and I can't eat a store bought cake anymore because I had it too much. Like,
I'm pretty much the same way. Although I will say when I would drive to work in the morning and pull into the factory and they were making chocolate icing, it was a little bit like walking into Willy Wonka.
Yeah, I always used to call it when they'd be doing icing days and also the filling days, the fruit filling, you could smell the sugar in the air. I used to call it diabetes air. And something I didn't know that I learned on the job was that sugar dust is actually highly flammable.
In storage rooms, the roof could blow off because if you had an explosion, you wanted to direct it in one direction. Yeah.
There were days, there were days where I'm like, I don't, I don't know how we're going to get through this. Like there were, um, so many crazy things. I got sent to factories after they just bombed for flower mites and it was nuclear material and project managers during like that whole refresh thing we did. And I got sent out for almost two years on the road. Yeah.
They're like, oh yeah, you could come back as like a superhero. And I'm like, it's not funny. You're paying my medical bills. Like, yeah. Do I need to call the corporate lawyer? Cause I will. I mean, we got to travel all over the world for that.
I got to see grain production in Germany and all over the country and everything that we did between our cold storage and our, our grain plants there and our flour mills and. This is just fun war stories for a moment, folks. But I remember standing in California and I won't name the facility, but I know you'll know it, Mike. It was one of our no, it was one of ours.
It wasn't one of our sister companies. I was in there like executive boardroom looking out. There was a window and there was an empty like lot next door. And I watched I remember sitting there with a coffee and I just happened to look out the window and I thought, that's weird. It was like a drug deal. I cried like 50 feet from our door. And I just remember thinking, where am I?
And then the time I was sitting at one of our sister companies in Vegas and there was a fire three doors down and I sat there and watched the smoke billow into the building and we didn't move because we had stuff to do. I remember the project manager I was with, he was like, you're not leaving unless you are told by the fire department to leave. And I was like, I'll never forget that.
The whole warehouse was full of smoke. Like, not really bad, but like enough that you were like, your eyes are watering. And I thought, wow, this isn't good. Like, this isn't good. There are other weird things that happen around the tech and things that I didn't ever want to see and I can't unsee now. And the amount of dumb things that employees do on computers, just insane. Dumb things.
Like if you're studying anatomy in school and you're using your work laptop, we have search engines that look for tags on words all day long in any language. I'll never forget that we stumbled upon this particular individual who was taking anatomy class and it was really bad. Like he had embedded these files into certain things and we're like, yeah, no, we're going to take that and reimage it.
and you're probably a big trouble buy. Like don't use your school laptop for school. There's so many funny things and the sales teams are always a riot. And yeah, they definitely kept me moving. Oh, they were always just a technology disaster away from not being able to function.
And going out to their offices was always a hoot because they were so excited because they never had anybody from the technology side ever on site. So they rolled the red carpet out for you. It was fun, definitely fun times, but it was always a really interesting experience.
is that that is symptomatic of the industry itself.
Hell yeah.
Which is why it actually, the industry of food in general has become an interesting place. You know, it's not necessarily that private equity owners thinks it's a place that they can, you know, exploit and make money because they see a lot of opportunity due to all of these inefficiencies and tendency on old legacy systems that, you know, shouldn't even be on the computer anymore.
They're so ancient. So that was where, you know, our owners, you know, They said, this is an opportunity to take a place that's, you know, run it on a Model T and let's put it on something a little more modern.
Yeah. The problem is the Model T still needed to run though. And the fact that they kind of bypassed that was really, really inconvenient to this process. Yeah. Yeah.
That play is, it's very common in the private, in the food world right now. It's because there's so much inefficiency that you can, you know, leverage technology. Yeah, that's true. That's true. And then one of the other vulnerabilities of that, though, is as you talked about how some companies don't, you know, they're not necessarily willing to or need to upgrade from the old legacy system.
The problem is, is a lot of those don't have the embedded textures that you would just get even off of.
or even just segmented away from everything else as a critical asset.
When they plug in some IoT device in the factory, and then, you know, it's all she wrote because now it's plugged into the bigger world and not isolated.
Well, yeah, and this is getting into more of a technical weed, but a lot of the networks inside of these buildings were flat, meaning everything was connected at all levels. They didn't have any staggering levels or like different levels. rooms you could walk into. It was just one open floor plan. That's what I described that networking term.
That causes the problem is if you don't create these little segments, whether it's your critical or production system or your office in the production area, it becomes so easy for people to hit, just hit one, you're in. But if you have this segmented section, it's almost like Swiss cheese. They can't get to everything. They got to kind of work their way through it.
That's why I always say, make it hard for these hackers. Make it hard. Don't make it easy. Don't be an easy target. You want them to struggle. Make them work for their money, literally. Once you start saying that, people are like, oh yeah, we should make this harder.
But the problem is, and you know this, Mike, that the second you make it harder for the hackers, it becomes harder for everybody else, right?
I mean, you know, 16 character, you know, email passwords and 90 day rotation on changing it out. Yeah. However, you know, the average person remembering multiple 16 character combos to put into your It gets to be all tedious. Yes. So then the next thing you know, you walk in their room and it's on the post-it note on their computer. Or it's saved on their laptop.
It automatically populates the iPhone. So you have folks actively working around your protections.
Yeah, especially on production floor. If you have biometrics and you're wearing goggles, it doesn't work. Or fingerprints, you're wearing gloves. There's cold and you can't get the heat. Yeah, or it's just cold. Or you're in some type of toxic environment where you can't do that. No, it's hard. This is why you have to work with people and process. And the tech has to work around that.
Back in the day, the legacy systems worked because that's all there was. And they stayed there because it was too expensive to upgrade the system or upgrade the software that runs on it. Some of the software upgrades, For when we were doing that whole process of the ERP upgrade, some of those were literally millions of dollars, Mike. It was stupid. What's the point?
That was the whole budget we have for the project anyways. Like, why would we do this? But it was the most critical system that couldn't be taken offline. Or people have been attaching their legacy systems to their current modern systems, whether it's an IoT or anything like that. I don't think that you need to give everybody access to everything. That's ridiculous.
That's kind of the breakdown, too, of access control.
Every type of precaution possible down to the point of thinking like, you know, it's like you both have to have two keys to turn the nuclear war.
Exactly. Yes, exactly.
Can't turn both at the same time because they're too far apart.
You know, and that's the important with aspects with like cyber physical, right? You still have to be able to turn the key, but you could push a button on your couch, right? That whole aspect, we now cross into physical security so much differently in the food industry. Down controlling peanut to non-peanut areas is an example to go back to that.
And I think that access control in that regard, especially it's part of our process. It should be part of what we do. It's hard. This is all hard stuff. And because you have to combat people, blame to them. You have to change the way you do your job that you've done for the last 40 years.
But we appreciate what you've done for the last 40 years, but now you need to adopt this particular aspect to it. But, oh, by the way, if everything goes down and it's bad, we need to be able to fall back on your original process. It makes people feel really inadequate and stupid. So you have to kind of get them excited about it and bring them to a new level of understanding with it.
And also, they can take it into their home. You know, they can understand how to stay safe at home. And I think that's the part. It's not exclusive to your company. You should be practicing these behaviors at home as well. Because if your email gets hacked at home, more than likely you have the same password. It will be tried on your work account. That's how they get in a lot of times.
So don't put your passwords the same. Change your password. That's right.
But again, back to that human nature of, oh, God, how many more passwords do I have to remember?
I think the nice thing is that a lot of people are adopting password creations and storage and things like that. And that seems to be good. Thanks, Mike, for being here. I was nice to it on memory lane and all these fun things. And I really hope you continue to expand your knowledge so you can share this with others as well.
Definitely something that we're thinking a lot about. Like I mentioned, you know, law firm worlds are, they're seeing attacks constantly as well. The bad people have figured out that we have a lot of information that they'd love to have their hands on. And if they can get something that's about a public deal, that's not public. And then again, in the legal side, meaning the lawmakers.
We're going to see more and more activity at Congress and state levels because this is an issue that they have to address. And unfortunately, we see on both sides of the aisle an interest in doing so. So it'll be interesting to see where they move on this in the next few years. But I suspect that we'll be talking again about whatever legislation they place.
All right. Well, thank you very much for being here, Mike. Really appreciate it. Thanks so much, Kristen.
Thanks so much for tuning in to today's episode of the Bites and Bites podcast. A big thank you to my guest, Mike, for sharing his insights, experience, and a few laughs.
Remember to like, comment, and share the show. Stay safe, stay curious, and we'll see you on the next one. Bye for now.