Logistics cybersecurity: risks, Brazil's LGPD and protection

The use of new technologies has become an important part of transport operations. However, as this use grows, we also need to be aware of the importance of information security in logistics.

Delivery drones, RFID tags that keep track of packages along the chain, electronic checklists, refueling control, among others, are examples of tools that improve the efficiency and productivity of an operation. However, they also represent a risk of privacy and data breaches.

Although they revolutionize the sector, making it more efficient and faster, the benefits come with certain risks that need to be considered when ensuring information security in logistics.

There is also a point that has changed since this debate began: a significant share of this information is personal data (of drivers, customers and suppliers), and in Brazil its processing is governed by the General Data Protection Law (LGPD, Law No. 13,709/2018). This moves information security from the field of good practice to that of legal obligations, with duties, deadlines and sanctions set out in law.

What is information security in logistics?

Information security in logistics is the protection of information and digital systems in the supply chain. It is the set of efforts and different actions to prevent the company's data from being lost or attacked.

This includes every category of data, from internal information about processes, vehicles and employees to the customer and supplier records stored in the carrier's system.

This distinction matters when setting priorities. Lost operational data is an internal loss; exposed personal data is, in addition, an event with legal consequences, and it is the nature of the data, not the size of the company, that defines which regime applies. If you have not yet mapped this point, a good place to start is applying the LGPD to fleet management (in Portuguese).

How can companies protect their data?

A fundamental action companies should take is creating a plan to deal with cyberattacks, including who will be responsible for responding and which measures will be taken. What is more, every employee needs to be instructed on how to stay protected online, knowing how to identify suspicious emails or websites.

This plan is no longer just a recommendation. In Brazil, the LGPD establishes, in its art. 46, that processing agents must adopt technical and administrative security measures capable of protecting personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of improper or unlawful processing. The law does not list the tools to use: § 2 of the same article only says that these measures must be observed from the design phase of the product or service through to its execution.

A few years ago, a basic antivirus against malware might have seemed enough, but today technology is very widespread and we see market giants suffering attacks. So this area calls for attention and dedication.

To start, the company should focus on communicating the measures to its team. Implementing new measures, efforts and procedures should always start internally.

If you have the resources for it, you can create an IT department within your fleet management or hire a specialist in the subject.

A common mistake in information security in logistics is the lack of a backup system. You need to determine which data must be saved, how often to make the copies and where they will be stored securely.

And it is worth testing the restore from time to time: a backup that has never been restored is a hypothesis, not a guarantee. The test also reveals how long the operation would take to get back up and running, information that is usually missing exactly on the day it is needed.

What are security breaches in logistics?

Information security breaches can occur when data is accessed or stolen by unauthorized individuals. This can happen through hackers, malware attacks or simply by stealing physical devices that contain confidential data.

Another risk is data loss due to a device malfunction. Sometimes a simple power outage can cause a computer to fail and damage the data that was saved on it.

That is why it is important to have measures in place to prevent you from completely losing your records or the data from falling into the wrong hands.

After all, when this data is compromised, it can result in financial losses, loss of customer trust and consequences provided for by law.

When the incident involves personal data, there is a duty to report it. In Brazil, art. 48 of the LGPD determines that the controller must report to the national authority and to the data subject the occurrence of a security incident that may cause relevant risk or harm to data subjects, stating, at a minimum, the nature of the affected data, the data subjects involved, the security measures used, the risks of the incident, the reasons for any delay and the steps taken to reverse or mitigate the effects. The deadline is not in the law (§ 1 refers it to the national authority), and the ANPD, Brazil's National Data Protection Authority, set it in its regulation: according to the agency's official page on the subject, the report to the ANPD and to the data subject must be made by the controller within up to 3 business days, under arts. 6 and 9 of ANPD Board of Directors Resolution No. 15, of April 24, 2024.

Note the scope: the duty falls on the controller and applies to incidents that may cause relevant risk or harm to data subjects, not to every technical failure. Since the assessment depends on the specific case, this is a decision to make with legal support, not on the basis of a blog post.

On the sanctions side, in Brazil art. 52 provides for, among others, a warning with a deadline for adopting corrective measures and a simple fine of up to 2% of the revenue of the private legal entity, group or conglomerate in Brazil in its last fiscal year, excluding taxes, capped, in total, at R$ 50 million per infraction. § 1 of the same article conditions its application: sanctions are imposed after an administrative proceeding that allows a full defense, in a gradual, isolated or cumulative manner, considering parameters such as the seriousness of the infraction, the good faith of the offender, recidivism and the degree of harm.

Organizations need to be aware of the risks associated with using technology in logistics and take steps to protect themselves from these risks. So:

How to ensure information security in logistics?

Whether by implementing sound information security policies and procedures, training employees on how to protect confidential data or using encryption technology itself to protect data against unauthorized access.

Against some of the threats, carriers can also count on modern firewalls and antivirus software. In addition, using the cloud is a trend in logistics (in Portuguese), and the reason is clear: even if you lose a device to a technical failure, your data stays safe and stored, accessible from other locations.

The cloud, however, changes the shape of the risk instead of eliminating it: access comes to depend on credentials, and a credential shared among the yard team can compromise much of the control the company is paying for. It is worth pairing the choice of supplier with internal access rules: who gets into what, and what happens when someone leaves the company.

By taking these precautions, organizations can help reduce the risk of information security breaches in logistics and protect their business interests.

Taking the time to properly plan and execute a security strategy can help prevent data breaches and other costly attacks. The main steps include:

1. Conducting a risk assessment, which helps identify possible vulnerabilities and determine which areas need more protection.
2. Establishing policies and procedures tailored to your company's specific needs, and everyone in the organization should be familiar with them.
3. Deploying appropriate security solutions, which can include firewalls, encryption software, antivirus programs, etc.
4. Testing systems regularly: by checking for weak points and running penetration tests, you can detect all vulnerabilities before they are exploited by malicious people.

One caution about the last step: a penetration test is agreed on before it starts, with the scope, execution window and formal authorization recorded, even when the company's own IT team is the one running it. Without this prior agreement, the test often stops halfway or is mistaken for a real attack by the team that should respond to it.

What are the information security procedures in logistics?

Five categories do a good job of organizing what needs to be ensured: access control, integrity, authentication, confidentiality and non-repudiation. They are not a standard created for logistics: they are the security services described in the security architecture for open systems interconnection, published in ITU-T Recommendation X.800, technically aligned with the ISO 7498-2 standard. The document itself defines its scope: it deals with the visible aspects of the communication path between systems, not with the security measures needed in facilities and in the organization. In other words, they serve as a roadmap of what to check, not as a certification to display.

To protect data and systems against unauthorized access, companies need to implement rigorous security measures, such as user IDs and passwords, firewalls and intrusion detection systems.

Data should also be regularly backed up and monitored so that any unusual activity can be dealt with immediately.

The growing use of mobile devices and cloud-based storage solutions has made it easier for employees to access company data from anywhere at any time, another risk that should be considered and planned for to increase your company's digital security.

As a result, companies need to make sure their security protocols are up to date and that employees are properly trained on how to use these technologies securely.

In transport operations, this point has a practical aggravating factor: much of the access happens outside the office, on a driver's phone, a gatehouse tablet or a shared workshop computer. Defining what each profile can see and reviewing that list when someone changes roles usually pays off more than investing in one more tool.

Now that you know the importance of having a strategy for information security in logistics, check out the main technologies to include in your fleet:

(video in Portuguese)