Balancing Digitalization and Security: Key Takeaways from the Cybersecurity Summit in Chicago

CPGs utilizing AI need to consider securing their models at three levels.

"First, when you're doing data collection, you have to be vetting it. If you're not, you're going to run into trouble. Secondly, as you're training the model, you'll have applications that may have vulnerabilities injected into them. And finally, as you're actually using the models, [hackers] are trying to manipulate behavior in the model. That's where the biggest source of black hat hacking is happening right now, is trying to get the models to misbehave," says Kalka.

The benefits of a move to the cloud

Consumer packaged goods companies are increasingly storing data in the cloud, with 80% of surveyed industry stakeholders at least partly storing data in the cloud, according to PMMI Business Intelligence's 2024 report, "Transforming Packaging and Processing Operations."

Ivan Gotti of Okta (left) and John Gall of Cloudflare (center) discuss cloud security with Darren Friedel, cybersecurity engineer at the Center for Internet Security at the Cybersecurity Summit in Chicago.Cloud computing can bring major benefits in flexibility, cost-efficiency, and scalability, but it also opens companies to potential security gaps, John Gall, solutions engineer at Cloudflare, and Ivan Gotti, senior solutions engineer at Okta explained at the Cybersecurity Summit.

Gall and Gotti see companies large and small in manufacturing and elsewhere wary of the potential dangers of cloud computing. They explain that knowledge is power when working with the cloud, and it helps to offload the responsibilities of managing data alone.

"It's not just mom-and-pop shops [that are wary of the cloud]; I see traditional manufacturing industries and government organizations that still want to keep their own data center. But there's a return on investment and a business value of using the cloud. You will not have the high availability and scalability that a big cloud provider could have," Gotti says. "The journey to the cloud can be complicated, but the key to having a good strategy is to educate and to balance the benefits of having a big company behind you with a strong service level agreement (SLA), and with strong scalability so you don't need to scale up your own servers, patching, maintenance, and then if a breach happens, it's all on your own."

Maintaining cloud security and avoiding misconfigurations, or errors made in cloud system deployment or maintenance, comes down to a strong cloud management strategy, and knowing that employees are the weakest link in cloud security.

"What you don't want to do is rely on your IT team to manage everything. You want to have appropriate access dispersed out among your different organizations," Gall says. "But alternatively, you don't want to have the wrong organizations having access to the wrong systems. Misconfigurations are human error; it's us misconfiguring things. We want to provide safeguards that enable us not to do those things, and utilize playbooks and repeatable processes. It's all about minimizing human error by making things repeatable, scalable, and only having the appropriate experts work on the material that they're experts in."

Assessing cybersecurity readiness

CPGs may have a few strategies and tools in place to protect their digital information, but how can they know if it's enough?

Subject matter experts answered this question by defining cybersecurity readiness and sharing evaluation tips at the Cybersecurity Summit.

"Cybersecurity readiness is about the preparation. I don't think companies do enough incident planning or tabletop exercises, and when they do, it's limited," explains Tony Anscombe, chief security evangelist at ESET.

A panel of cybersecurity experts (from left to right: Mans Jabal of Deloitte, Tony Anscombe of ESET, Beth Miller of Code42, Chad Monteith of Pure Storage, Adam Vande Ven of Capital Data, Muamone Yang of Thales) discusses the definition and evaluation of cybersecurity readiness at the Cybersecurity Summit.Anscombe notes the importance of having a contact list ready, preferably on paper, when technology fails during a cybersecurity emergency. "[Companies] should already have that list, and that's why you should be doing tabletop exercises. The people you think you need to contact might not actually be the people you need to contact in an incident."

Protections should be built deep into digital systems with a "bottom-up approach" to ensure data is secure, according to Adam Vande Ven, director of innovation at Capital Data, representing Veeam Software at the event.

"Oftentimes during the continuous cybersecurity readiness conversation, we put a lot of effort into looking at front-end security measures like firewalls, EDR solutions, and managed detection and response. But some of the most important things to consider are in the underlying infrastructure," Vande Ven says, noting the importance of incident recovery. "If the company has backups, are they immutable? Are they on different mediums of storage so that in the event of vulnerability, the company can recover? Then thinking about different tiers of that immutability and recoverability strategy so that the company can recover as quickly as possible, depending on the threat."

After a CPG establishes a strong cybersecurity posture, the job is far from over.

"You need to do this continually. This is not a one-and-done scenario," says Anscombe. "Companies get acquired, we grow, other people come in and employees start using things they shouldn't. It's a continually evolving environment that you need to audit."

As companies maintain cybersecurity, they can rely on indicators that their strategy is mature and robust.

"One key indicator of organizational success is limiting the blast radius of an attack," says Chad Monteith, principal field solutions architect at Pure Storage. "If a company can implement good processes, procedures, and exercises that test how far somebody can get into that blast radius, that's a real indicator of maturity. Even if an attacker comes in and compromises one area of your business, if they can't actually get to other areas, you've substantially limited the impact of that attack."

As technologies like AI and cloud computing evolve, CPGs need to strike a balance between embracing emerging technologies and staying vigilant about cybersecurity, ensuring innovation doesn't come at a cost to security.