As workers clear shelves of rotten food and tabulate the cost of the recent cyberattack against supermarket chains in France, it’s become evident that industrial automation cybersecurity in retail operations is paramount in order to ensure food safety and security. Attackers demonstrated their ability to remotely access and disrupt refrigeration controllers, manipulate temperatures, and destroy food stocks. The impact goes beyond the financial cost to business; more than 300 stores were impacted, limiting certain food availability in each locality.
Supermarkets aren’t the only retailers or critical infrastructure businesses reliant on controllers such as the Danfoss and Copeland devices compromised in the France attacks. The safety and availability of cold-chain storage facilities in other aspects of food distribution, healthcare and pharmaceuticals facilities, and chemical and industrial materials also rely on automation to fuel their respective supply chains.
In this blog, we’ll explore industrial automation cybersecurity, and what it means to defend these assets in the retail sector. We’ll cover:
Securing industrial automation in connected retail environments
AI’s role in retail automation
Cybersecurity priorities for retail leaders
Industrial automation in retail operations such as smart store fronts, distribution centers, and cold-chain storage facilities has progressed far from the air-gapped origins it once had. Relatively recent connectivity linking automated processes to the cloud and corporate networks, not only improves analytics, inventory management, and overall operational efficiency, but it also expands the attack surface immensely. While the origin of the supermarket attacks has not been made public, internet-facing assets that are not connected in a secure fashion behind a VPN, or guarded by strong authentication are clearly at an enhanced risk for disruption or damage.
Understanding Industrial Automation Cybersecurity Risks in Retail
Retail organizations are connecting industrial automation systems to corporate networks and cloud platforms to improve centralized management, energy efficiency, predictive maintenance, inventory management and operational visibility. This means that once-isolated building-management, logistics, or store-front systems are now part of the enterprise ecosystem. Security and business leaders looking at the attacks in France must prioritize their protection and ensure the safety and availability of physical processes in order to keep products, distribution, and supply chains flowing.
Exposures such as vulnerabilities in enterprise software or excessive access to systems and processes central to production are all new pathways to disrupt retail output. This is putting pressure on chief information security officers and operations teams to understand the architecture of their environments and apply controls where necessary in order to ensure availability, overall operational resilience, and rapid recovery in the event of an incident.
Third parties such as integrators, vendors, and suppliers also introduce considerable risk that must be managed. A recent Claroty survey of 2,000 technology, business, and security leaders revealed that 75% of organizations responding to the survey had been compromised because of a third-party relationship and those incidents had impacted operations. Furthermore, half of respondents said they had only partial or, in limited cases, no monitoring of third-party connections.
How AI-Powered Decision-Making Introduces New Cybersecurity Risks
Artificial intelligence (AI) and large language models (LLM) are bringing additional enhancements to retail and accelerating digital transformation in many cases.
There are tradeoffs with new risks being introduced as well; externally, attackers are making use of the same AI capabilities to rapidly scan software and firmware for exploitable vulnerabilities or configurations, and developing exploits with similar speed.
Claroty Team82, for example, demonstrated the capabilities of AI-powered research in the wake of the supermarket attacks. Team82’s original research into the Danfoss and Copeland controllers uncovered more than two dozen collective vulnerabilities. That work took months of manual examination. After the attacks, Team82 used an AI agent and publicly available vulnerability data and analysis tools to recreate their original research in less than 30 minutes and for $6 in fees. The barrier to entry is extremely for attackers fluent in these advanced technologies.
Retailers are finding benefits with AI. Respondents to the Claroty survey said AI is improving overall operational efficiency (57% of respondents), decision-making (47%), and enabling new business models (37%). However, frontier AI models have forever altered vulnerability management for enterprises globally. New CVEs from vendors are flooding organizations on a regular monthly or quarterly cadence, quantitatively making it near-impossible to keep analysis, testing, and implementation of fixes on pace with the introduction of new security issues.
Security and business leaders have decisions to make in the near future in order to rein in these risks. Here are three priorities that retail leaders may adopt in their environments.
Three Cybersecurity Priorities for Risk Reduction in Retail
Strengthening Asset Management and Visibility to Enable Operational Resilience
Retail environments are rich with industrial automation systems, including smart internet-of-things devices such as sensors that feed data to robotics systems and other critical assets that keep processes running. Everything either directly communicates to the internet or an internet-adjacent system exposing once-isolated automation systems to risk. This requires the development and maintenance of complete asset management capabilities starting with visibility into connected assets. Visibility then informs an asset inventory that brings rich context to the rest of the security program. Asset information, protocol identification, and vendor IDs enable exposure management systems, for example to correlate assets against known CVEs. Decision-makers can use this information to prioritize which assets are remediated or isolated in the event of a compromise.
Using Network Segmentation to Protect Retail Automation Systems
Industrial automation systems in retail must be segmented away from enterprise networks and other remote connections that might introduce intolerable risk. Asset management and inventories can identify pathways between assets, especially on flat industrial networks, that can be leveraged for lateral movement. Virtual network segmentation capabilities allow for engineers and operators to identify key assets and isolate them if they are compromised in an incident. This limits the blast radius of an attack to just the impacted assets and allows for a quicker recovery. This is the essence of operational resilience. In a retail environment, if logistics systems or store fronts experience downtime because of a cyberattack, the costs can be considerable. From the Claroty survey, 62% of respondents from retail said they experienced an incident impacting operations, with a mean financial impact of more than $930,000. Meanwhile, 21% of organizations experienced up to 2 days of downtime.
Leveraging AI to Improve Retail Industrial Automation
Retail organizations are using AI to analyze the data generated by industrial automation systems in order to do predictive analytics and maintenance of critical systems, bring efficiency to process behaviors, and from a security perspective, AI can identify baseline behaviors such as unexpected communication between assets and the internet, and alert on deviations. For defenders, AI can be used to bring invaluable context to operational security. At machine speed, AIcan correlate vulnerability with asset impact information, bringing key business context to decision-making about remediation or segmentation. It also can alert on unexpected changes to automation systems and analysts can use this context to make a determination whether the change is malicious. AI makes context-rich recommendations and reduces the time it takes to make critical decisions in the event of an incident.
For retail organizations, industrial automation security is ultimately about more than protecting technology. It is about protecting the physical processes that keep stores open, products safe, customers served and the business operating. These are the hallmarks of operational resilience and business continuity.
Talk to an expert about industrial automation cybersecurity in retail, and Claroty xDome.
