 It's time for On the Farm in Alabama, bringing farmers and agribusiness the latest news from Alabama Extension and the Auburn University College of Agriculture. Now here's your host, Alabama Extension regional agent, Eddie McGriff. Good day. I'd like to welcome everybody today to On the Farm in Alabama and today is my guest. I have Mark Sox, who is with the College of Engineering at Auburn University. Mark, tell us exactly what you do. Good morning, and good morning to everybody else. So in the College of Engineering, we have an institute called the McCrary Institute and we look into cyber and critical infrastructure issues working with engineering and also working with agriculture and other schools within Auburn. We try to bring together policies from Washington technologies like we might find up in Huntsville or other places, and of course academics on campus. My role is primarily with cyber security and I've been involved in cyber security for several decades. Well, that's one thing we don't concentrate as much as we need to in agriculture and agribusiness and that is agrasecurity and cyber security. Tell us, what are the biggest risks to agribusiness in agriculture in general? Yeah, Eddie, I think a big problem is one that everybody faces and that's threats from criminal groups that like to use a technique called ransomware. So we all get e-mail and oftentimes we get e-mails that are fishy, so we know that they're bad. It might come with an attachment or a link to a website. If we click on it or follow it, oftentimes it might then pop up something that says we need your login information, username, password, or it might even infect our computer. And the worst situation we've seen this happen to several businesses here in Alabama is that that infection then grows and it starts on the victim's computer and then grows into other computers within the business and then locks them up. What the criminal groups try and do is either take information from you, which they can sell to others or they can put out on the web for others to look at, or they might just simply lock up your hard drives and then you get an e-mail or maybe a pop-up on the screen that says that if you want your information back, you have to pay a ransom. Most of those ransoms could be in the thousands of dollars, so we've seen them in the hundreds of thousands and in some cases even in the millions of dollars. If an organization is well prepared for this, if they treat it like a flood or a fire, maybe they bet backups, they can recover from it. But unfortunately many organizations, and I've worked with a number here in Alabama, that were not prepared for that and they wind up having to pay the ransom in order to get their information back. The FBI and others are following and investigating this. This problem's been around for a few years. Their advice is not to pay the ransom. Their advice is to be prepared for it. Have backups. Have a plan. Be ready just in case something like this happens. But the best step, of course, if you get hit with a ransomware attack or some sort of criminal attack is immediately to notify the FBI or at least local law enforcement. Turn off your machines to try and prevent this attack from spreading any further. But before that even happens, the best way to keep from getting attacked or to keep ransomware from getting in is to make sure everybody in your organization understands the threat, understands that email is probably where it's going to come from, that you're running antivirus software on your computers, that you're really thinking about email before you open an attachment or websites before you click on a link, and you can avoid this type of problem long before it would come into your organization. Well, there's a lot of risks from cybersecurity. What about a lot of farmers depend on the agriculture cloud for auto steer, for collecting yield data, they've gotten or have gotten more and more dependent on the computers and their tractors and their combines? What risks is there to the cloud as far as agriculture is concerned? So it's interesting if we talk about cloud computing versus cloud farming. So we're not really being real clouds in the sky, but of course it's a new term that's emerged over the past decade or so that in the old days computers stand alone, like if you had a computer in your tractor and your combine it would collect data, it would process it locally, and you might have a little display that would tell you move left, move right, you know, slow down speed up, change your seating, things like that. Today what's happening is that data rather than staying local in your machine goes up through the internet to what's called a cloud service provider. You've probably heard of Google or Amazon Web Services, places like that. The equipment manufacturers, John Deere and many others, maintain instrumentation now inside these cloud services. So your machine will then talk to the manufacturer. They can analyze the data, they can send back to you the information that you need. So rather than it happening right there on the machine, it's happening in the cloud coming back to you. Now if you could imagine adversaries of ours, Russia, China, other places, if they could gain access to that information in the cloud, they literally could modify it. So you think you're planting a straight row and in fact it's not as straight as you thought it was, or you've got a certain seed combination and it's not exactly like it should be your fertilizer range or other things. Now these are hypothetical examples. We've not seen them happen yet. Again, the federal government is very aware of this possibility. So as a farmer, as a grower, it's imperative that you make sure if your machinery is using this type of service, it's uploading data to a manufacturer's cloud or some person you're working with, that in fact everything is updated and patched. That if software needs to be updated, that you update it as quickly as you can, read the bulletins, read the safety warnings, make sure that what you're doing is following exactly as the manufacturer tells you to do that. If you have any questions, of course, go back to your dealership. Go back to where you brought your equipment. They're ready to answer those types of questions. We could see this as a growing threat in the future. I think we're all aware of the case with Russia invading Ukraine. Some of the tractors in Russia were disabled, remotely disabled, kind of as a show of force that says, hey, we can do this to you or maybe even as a protest to those actions. Could that happen to us here in America? Well, theoretically, yes. We haven't seen it happen, but I think it's reasonable to be aware of that. Another piece to think about, too, is if you're doing everything computer-based, make sure you at least have some kind of manual backup. So the computers can fail. It doesn't have to be a Russian attack. There could be a glitch or something with the computer. Make sure you know how to run it in manual mode, that you can still do that. It may not be as efficient. Yours may not be as perfectly straight. But if you forget how to do things in manual mode, then if the computers die or get attacked, then you're sitting there not being able to do any farming. And this, of course, that advice applies beyond just farming. Just about anything that's computer-controlled. Make sure we have a manual backup, or at least we understand how to do it by hand if we have to. Well, are there any other major cybersecurity concerns that agribusiness or agriculture farmers in general need to be concerned about? So I think that, as we mentioned, the ransomware piece, be aware of it and be careful with what you click on in the email. Don't be too worried about somebody attacking the systems, as we just mentioned, the cloud thing. That is still a theoretical option. But the big issue that everybody needs to do, of course, is to keep your equipment updated. So if a software patch comes out, an update comes out, please don't delay. Get that updated. Generally, the manufacturers of these things are on top of it. They know if there's a problem, they'll send the update. This is very much like a recall. If you remember, your car, your truck might get a recall, but you don't want to wait weeks or months to go in to get the service. Just get it performed. I would also be aware of anything that's unusual. So if a piece of equipment's not working the way it should be and it's not really clear why, don't immediately think it's a cyber attack, but don't rule that out either. At least call, ask for help. Make sure it's that it is just a malfunctioning piece of equipment that can be repaired. So awareness is a big thing. Families need to be aware. Be careful with what you do at home. Be careful with your phones. They can also be a way for bad actors to get in. Other than that, these technologies that are emerging are very good, very powerful, and increase the way we can do things much more efficiently. At Auburn, we're looking into different types of attack vectors. We're working with our students and researchers to make sure we understand the dependencies and how the computer systems work. We work with the manufacturers also. So we will also be doing a larger amount of cybersecurity work within the School of Agriculture, within the extension services, a lot of outreach. So look for more, and you'll be seeing more coming from Auburn in terms of how to best protect your equipment, your farm, your businesses, as the threats in cyberspace begin to grow. All right, we want to thank Mark for being with us today on the farm and everybody for tuning in.