Expert Cybersecurity Guidance for Small to Mid-Size Trucking Fleets

By Bianca Prieto, Editor of The Inside Lane

Cybersecurity is critical in safeguarding your trucking fleet from attacks that could potentially halt your operations and endanger your business.

Understanding this, we've invited Lee Lackey, a seasoned Product Manager at Noregon with over 30 years in the commercial trucking industry, to share his expert insights.

In this Q&A, Lee provides essential tips and guidance on fortifying your trucking company's cybersecurity measures. Being well-prepared not only protects your fleet but also saves you time, money, and potential disruptions.

Let's get to it.

Inside Lane: Can you share a bit about your role at Noregon and your experience in the field of cybersecurity, especially as it relates to fleet management?

Lee Lackey: I'm Lee Lackey, and I serve as a Product Manager at Noregon. I bring over thirty years of experience in the commercial trucking industry to the table. My career has spanned various roles, including consultant, software engineer, and estimator, giving me a broad perspective on the industry.

In my current role, I'm particularly focused on overseeing Noregon’s product security. This involves monitoring our products to detect any breaches and collaborating on the development of new security measures to protect against hackers. Additionally, I am an active member of the SAE committee for the J1939 standard, where I have contributed to the creation of the latest generation of security documents. This work is vital as it ensures that fleet management systems are not only efficient but also secure from potential cyber threats.

Reacting to Cyber Attacks

IL: Could you outline the steps you advise a small to mid-size fleet company to take immediately upon discovering a cyber attack?

LL: Companies need to have plans in place so they know how to react if an attack does occur. In general, below are a few things that companies can begin doing immediately if they discover a cyberattack: 

1. Contain it. 
2. Assess the scope.  
3. Utilize your instance plan.  
4. Contact any relevant authorities.  
5. Preserve the evidence of the attack.  
6. Implement necessary emergency measures. 
7. Contact your customers accordingly: Don't wait too long to notify them of the issue. It's a difficult conversation to have, but customers deserve a warning.

Cybersecurity Practices

IL: In your view, what are the most critical cybersecurity practices small to mid-size fleet companies should implement to safeguard their operations?

LL: Here are several best practices:

• Strong Access Control: Keep your production systems separate from your core network, so only the people that absolutely need to know have access.  Have a system that requires approvals for new security clearance.  Part of your off-boarding process needs to be revoking security privileges as soon as possible after an employee leaves the organization.
• Patch and Update Systems: Whether it’s your operating system or the various applications on your devices, download and apply patches and updates whenever they become available. These updates typically include security enhancements and present one of the least expensive methods of avoiding zero-day attacks.
• Employee Training and Testing: Train your employees and ensure you routinely test them with methods such as staged phishing emails. These tests are a manageable practice for companies to help employees retain their training without significant financial investment.
• Separate Networks: Consider outsourcing IT for your shop machines through a program like Noregon’s Diagnostic Tool Management (DTM) service. DTM customers have the option to host their shop devices on cellular networks separate from their business systems and lets Noregon manage all aspects of those devices from cybersecurity measures to software procurement and management.

Strategic Investments

IL: For fleet companies with budget constraints, what cybersecurity measures do you believe offer the most significant protection for their investment?

LL: Regarding cybersecurity training, bringing in a cybersecurity professional to help train your employees may not be a practical option. However, there are other cybersecurity measures that companies can take:

• Web-Based Training: It’s important to regularly provide your employees with web-based training to keep them up to date with the latest threats and reinforce policies for mitigating these threats.
• Multi-Factor Authentication: Multi-factor authentication is an inexpensive method to greatly reduce instances of unauthorized access.  
• Update Your Software: It's essential to update your software when applicable. When you purchase equipment, you've typically already purchased any software updates or patches that come along with it, so apply them. Companies often forget or push off updating their software, leaving themselves vulnerable by not having the latest security measures.

Vulnerability Insights

IL: Based on your experience, how can fleet management companies best identify and mitigate their vulnerabilities to cyber threats?

LL: Based on our experience, fleet management companies can best identify and mitigate their vulnerabilities to cyber threats with two tasks in mind:

• Complete a Risk Assessment: Companies should conduct a risk assessment to understand how external communications flow into their organizations, as this is where attacks are more likely to occur. Don’t forget to consider the risks of social engineering attacks on employees who deal with the public via phone or other methods of personal communication.  
• Develop a Plan & Test Incident Response: No company should wait until an attack occurs to ask, "What do we do?" Instead, they should be proactive before a potential security breach by consulting with internal and external cybersecurity experts to develop response plans.

Importance of Training:

IL: From your perspective, how crucial is employee awareness and training in preventing cyber-attacks within fleet operations, and what should such training emphasize?

LL: Many attacks start as social engineering attacks. Therefore, it’s vital to continuously train your employees and follow up that training with testing procedures. For example, train your employees to spot and report phishing emails, then test their knowledge in the following weeks with fake phishing emails.

Data Management Advice

IL: How do you recommend fleet companies manage and protect the vast amounts of data generated by their vehicles to avoid cybersecurity issues?

LL: Fleets often face challenges managing the vast amounts of data their vehicles generate. To avoid cybersecurity issues, it is essential to prevent data injections by putting checks in place and ensuring that the database isn't running any questionable queries on the data it consumes. 

Fleets must also understand the potential damage resulting from data compromise. To prevent these issues, partner with organizations you trust. Purchase legitimate copies of trusted diagnostic software and utilize reputable companies for your telematics needs. Ask your telematics or diagnostic provider what measures they take to protect vehicle data.

Be aware there is a black market for hacked software and its price point can often be enticing for businesses or individuals, but illegitimate software carries many risks including being a prime candidate for injecting ransomware or malware into your network.

Technology Collaboration

IL: How should fleet companies work with their technology providers, like Noregon, to bolster their cybersecurity posture, in your experience?

LL: Fleet companies should collaborate with vendors on threat assessments. With this, a few questions should be considered: How can you protect the laptops we've purchased? How often do you work on software development? 

Companies like Noregon provide stable product development, a testament to our reliability. For instance, we have recently introduced the DLA+ 3.0, a next-gen adapter, and offer regular JPRO and TripVision updates for each customer, ensuring the security of your laptop. Moreover, we help you manage your laptop's security, as it's not directly tied to their networks. If one of the laptops is compromised, it won't be directly connected to the network, as it is essentially an outsourced device.

Compliance and Cybersecurity

IL: How do cybersecurity measures intersect with regulatory compliance for fleet companies, and what compliance aspects should companies be most aware of?

LL: Many regulatory compliance centers help keep records of business compliance over time. Making sure that you have secure backups off-site can help minimize any damage. Part of the incident plan should be suspending backups until a full assessment has been done to prevent compromising good data. The last thing a company wants to do is backup a broken or hacked system. Like locking your front door but forgetting to lock the back, not securing your backups can still leave your business vulnerable to threats.  

Anticipating Future Threats

IL: Based on your expertise, what emerging cybersecurity threats should the fleet industry be aware of, and how can companies prepare for these?

LL: Social engineering hacks will get more advanced with the rapid advancements of AI technology. For example, it is now possible to replicate a person's voice with less than 30 seconds of recording. Realtime deepfakes could allow what looks like your boss to order you to take action that compromises the company.

The Inside Lane published a three-part series on cybersecurity in the fleet industry. Trucking companies and their fleet vehicles are susceptible to hacking, and taking steps to safeguard your company's assets is paramount. The series delves into this important topic with real life examples, tangible tips and easy to implement actions.

Part 1 takes a look at the alarming trend of cyberattacks in trucking, a sector integral to the U.S. economy. Industry experts highlight the critical need for advanced cyber defenses. Read it here.

In Part 2, we delve into the realm of cyberattacks, examining vulnerabilities within truck and fleet operations and the measures being implemented to enhance security. Read it here.

Part 3 provides strategies, tactics, and tips to help small and mid-sized trucking companies fortify their defenses against cyber threats. Read it here.

Have a question or comment about this article? Email Bianca Prieto at editor@theinsidelane.co

Not yet a subscriber? Join here.