The New Cybersecurity Threat Facing Public Fleets

Imagine every connection into a fleet as an open door.

Telematics opens a door. Mobile devices open another. Cloud-based fleet information management systems, backup cameras and GPS systems open even more. These entrances deliver access to the data and connectivity fleets need, but they also must be secure.

Today’s public fleet is an interconnected web of vehicles, telematics, fleet management systems, GPS, cameras, mobile devices, cloud platforms and outside vendors. Drivers, technicians and dispatchers interact with these systems throughout the day, often from the field.

That connectivity gives fleet managers visibility into their operations, but every new connection opens another door to fleet data. And cybercriminals look for the backdoors left unlocked.

As connectivity increases, Amar Singh, CEO of Cyber Management Alliance and a practicing virtual chief information security officer (vCISO) to multiple organizations at board level, said it leaves the door wide open to fleet data and assets. A vulnerability with a telematics provider, cloud platform, software vendor or other third party can provide an opening for cybercriminals to exploit.

But before fleet leaders slam these doors shut and view connectivity as the enemy, Sean Herron, chief information security officer at Samsara, said those same connections can become part of the defense. Connected technology, he said, can help fleets track assets, identify unusual activity and spot behavior that doesn’t fit established patterns.

The Target on the Front Line

Cybersecurity training typically follows a familiar script: Don’t click suspicious links. Don’t open unfamiliar attachments. Watch for phishing emails.

Though these warnings still apply, Herron cautions that employees sitting behind a computer are not the only targets. Drivers, technicians, dispatchers, supervisors and other frontline employees can also give cyber attackers a foothold in fleet operations.

He said cyberattacks are becoming “more targeted, more convincing, and more operationally aware.” Attackers leverage knowledge of organizational routines to convince employees to do things they normally wouldn’t.

Artificial intelligence (AI) has accelerated this shift. “AI and large-scale computing has dramatically driven down the cost and complexity of going after frontline operators,” Herron said.

Singh agreed. “AI has significantly lowered the barrier to entry,” he said.

He said mounting a complex cyberattack once required knowledge and skill. But AI puts those capabilities into the hands of people with far less expertise, which increases the number of potential attackers and makes it harder for organizations to keep pace.

Rhonda Syler, an associate professor at James Madison University and chair of the Commission on Information Technology for the City of Alexandria, Virginia, warns that AI makes phishing, telephone scams and other social-engineering attacks easier and more sophisticated.

In social-engineering attacks, she said, hackers have long used information about individuals, organizations or jobs to personalize emails, texts and calls. Generative AI now enables them to turn that information into tailored communications much more quickly and on a far greater scale. They can also use AI voice-cloning technology to make fraudulent calls sound as if they are coming from someone an employee knows and trusts, making these already successful attacks even more convincing.

Cyberattacks Get Physical

“Attackers are using digital paths to exploit physical assets in a way that we haven’t seen in the past,” Herron added.

Cyber-enabled cargo theft offers an excellent example of how these attacks work. In these attacks, a cybercriminal poses as a dispatcher and sends a driver new delivery instructions. Believing the request is valid, the driver changes course and delivers the load.

“By impersonating someone the driver trusts, the attacker turns a digital deception into physical theft,” he said.

Such attacks may look different in public fleets that support police and fire departments, snow removal, utilities, sanitation, road maintenance, parks, inspections and other essential services. They can disrupt vehicle routing, location services, maintenance or communications and impact services residents depend on.

Cybersecurity in a public fleet, therefore, must protect operations as much as it does data, Singh said.

To illustrate the disruption that telephone and social-engineering attacks can cause, he points to the MGM Resorts ransomware attack, where hackers breached 37 million people’s personal data and halted operations for nine days. In this case, the attacker used social engineering to convince a help-desk employee that a caller was someone they trusted.

“Fleet leaders must ask themselves: How susceptible is our fleet to social engineering attacks?” Singh said.

Move Training Out of the Office

The first step toward better protecting a fleet is to move cybersecurity training outside the office, according to Herron. Drivers, technicians, dispatchers, supervisors, temporary employees and contractors should also be taught how hackers may target them.

“Extending that education to frontline workers is a really critical thing for organizations to do,” he said.

Cybersecurity training should teach employees to verify unexpected instructions, particularly those involving route or work-order changes. They should question unusual urgency and examine sender domains and caller information. They should also know how to independently confirm a request. When something seems amiss, they must be taught to report it quickly.

Don’t Forget the Basics

Start with the basics. When fleets patch systems and lock down their data, they control who has the keys to their connected devices.

Patching is a simple defense, but keeping fleet operations moving can make it tempting to put it off. Taking a system offline can interrupt operations and stretch IT resources, leading many fleet managers to delay these efforts.

Singh warns against postponing patches. “If Microsoft or another software vendor comes out today and says patch, in my professional opinion, you should patch immediately,” he said.

He also recommends encrypting fleet data, particularly data at rest. Other locks on data doors include access controls, monitoring, data protection and limiting system access to authorized users.

Critical tools like strong passwords and multifactor authentication deny cybercriminals access. Singh recommends using a one-time password or authenticator in addition to usernames and passwords because it adds another barrier for hackers to overcome.

Using strong credentials is vital because they close the doors to hacking. Singh boils that down to an equally simple phrase: “No credentials, no hack.”

Leverage Technology

Connectivity creates systems that require protection, but Herron said it can also help fleets spot trouble sooner.

Herron said a person cannot simultaneously watch the movement of hundreds or thousands of vehicles, monitor every device and notice every abnormal transaction, but technology can. For this reason, he says fleets need intelligent tools capable of identifying “patterns at scale that humans may miss.”

By leveraging these tools, a connected system can pinpoint when a vehicle leaves its prescribed route and flag it for follow-up. Similar analytics can also identify geofence violations, unexpected asset transfers or actions that don’t align with assigned workloads.

Scrutinize the Supply Chain

One of the biggest cyber risks facing public fleets may come from outside the organization.

Fleets depend on telematics providers, FMIS platforms, cloud services, mobile technology, cameras and other outside systems. Singh calls this supply-chain or third-party risk and stresses that if these tools are not secure, a fleet may suffer severe consequences.

When procuring new tools, he recommends asking vendors to include specific security requirements in their contracts. “When dealing with third parties, you must dot your I’s and cross your T’s before entering a contract,” he said.

Asking for cybersecurity certifications is a good idea, but Singh cautions against treating a certificate as proof that a vendor is secure. “Always be skeptical rather than trusting,” he said.

Herron also recommends asking vendors how they monitor their systems, detect abnormal activity, control access and respond to a data breach.

Test the Plan

Even the strongest defenses cannot guarantee a fleet will never experience a cyberattack. For this reason, Singh said fleets need an incident-response plan that is proven and tested.

“But most incident response plans have never been tested,” he said. “They’ve just been created to satisfy people.”

Singh recommends testing plans at least annually, depending on the organization’s size, noting that something as basic as an outdated contact can derail a response. “The most effective way to test a plan is a tabletop exercise: walk your leaders and drivers through a realistic scenario before a real one hits,” he said. “That’s where you find the outdated contacts and the gaps no document reveals.”

Vendors also must be prepared to respond, Singh said. Fleet leaders should ask when a software provider last tested its incident-response plan, who the fleet should contact if an incident occurs and how quickly the vendor can respond.

Planning and testing operational responses to technology failure is also crucial. Suppose a cyber incident cuts communication with 1,000 fleet vehicles. “Now, what do you do? What does the fleet’s drivers do? Do they know what to do?” Singh asked.

Do drivers park and wait? Do they continue their assignments? Is there another way to communicate? Does someone know their last location? What happens if the system isn’t restored in an hour, but remains down for five days?

“Most people would simply freeze and just wait for the system to come back up,” Singh said. “But what if the system takes five days to come back up? Do they not operate for five days?”

Those questions move incident response out of the IT department and into the fleet manager’s office. Singh recommends periodically pushing work plans to employees’ mobile devices, so they retain access to assignments should systems go down.

“The solutions will vary by fleet,” he said. “The point is to establish alternative processes before they’re needed.”

Protect the Mission

As AI makes attacks faster, cheaper and more convincing, the people operating vehicles and equipment must become part of the defense.

A compromised fleet system can affect whether a snowplow reaches its route, a public works crew receives an assignment, a squad car remains in service or an employee follows fraudulent instructions.

Protecting the modern public fleet from cyberattack involves protecting the data, and the people, vehicles and public services connected to it.

The more connected a fleet becomes, the more entries there are to protect. Fleet leaders may not be able to close every door, but they can make sure cybercriminals don’t find them standing wide open.