A Cybersecurity Playbook for Trucking in 2025
[Stay on top of transportation news: Get TTNews in your inbox.]
With another year of hacker break-ins looming before us, now is a great time to evaluate cybersecurity for your trucking business to ensure that you’re using the latest technology to keep cybercriminals at bay.
The freight transportation industry, which depends on technology around the clock for operations and customer service, has become a high-stakes target for attackers, said Tom Baughman, executive vice president of information technology at bulk hauler Kenan Advantage Group, which ranks No. 21 on the Transport Topics Top 100 list of the largest for-hire carriers in North America.
“Even short disruptions can translate into significant operational and financial impacts,” he said.
Here are 10 tactics cybersecurity pros recommend to help ensure that breaking into your computer network is — for hackers — simply too overwhelming to attempt:
Consider Zero-Trust Architecture
A relatively new approach in business network security, this strategy is based on the assumption that cyberthreats can originate both outside and from within your computer network.
Dysart
Ergo, you must unfortunately proceed with a philosophy of “trust no one.”
Zero-trust architecture begins with micro-segmentation — or the slicing up of your computer network into smaller segments — each of which has its own set of security controls. Ideally, a hacker can be trapped in a single segment of your network if you’re using micro-segmentation.
Next, you’ll want to implement the concept of “least-privilege access” across your network by ensuring that employees only have access to the systems they absolutely need to do their jobs.
READ MORE
► TMS Software Providers Tailor Offerings to Meet Fleets' Needs
► How AI Is Shaping the Next Generation of TMS Development
► TMS Products for Freight Brokerages Focus on Efficiency
► Cybersecurity Firm Irdeto Turns Focus to Trucking
► Dysart: A Cybersecurity Playbook for Trucking in 2025
And finally, you’ll want to adopt multifactor authentication across all systems in your network — such as the requirement of a password, followed by the need for a separate code sent to the user’s smartphone.
“Implementing a zero-trust security model, which assumes no user or system is inherently trusted, is crucial as businesses rely on more interconnected systems and cloud-based services,” said Sandeep Pulavarty, chief information officer at truckload carrier Paper Transport. “This approach ensures that every access request is continuously verified, reducing the risk of unauthorized access to critical systems.”
Paper Transport ranks No. 93 on the for-hire TT 100.
Continually Train Employees
Since the dawn of hackers, cybersecurity pros have known that fooling employees is one of the easiest ways to break into a business network.
Mohabir
“Most cyberattacks originate from human mistakes, often due to a lack of proper training and awareness among staff,” said Paul Mohabir, director of information/system technology at Transervice Logistics. “In large organizations, it’s crucial to ensure that all users are properly trained to stay alert for scams and phishing attempts.” Transervice ranks No. 92 on the for-hire TT 100.
Friendly-sounding emails soliciting employees for passwords, harried phone calls asking for emergency computer access, company laptops lost on trains or in coffee shops — these and similar scenarios are all nightmares that computer security officers toss and turn over regularly.
Security pros advise that every business that uses computers and the internet — no matter how small — create a cybersecurity training program for all employees.
Staheli
Some businesses even contract special security monitoring services that try to trick employees into surrendering passwords or granting network access, then refresh employees who fall victim to the ruses on deterrence protocols.
Key among those protocols, according to Cory Staheli, chief information officer at Trans-System, is to have fail-safe responses in place when you spot suspicious activity on your network.
“For example, calling your boss back on a known number to verify he just approved a large wire transfer,” Staheli said.
Trans-System ranks No. 84 on the for-hire TT 100.
Backup, Backup, Backup
Even in 2025, it cannot be said enough that every shred of data generated by your network needs to be backed up numerous times.
Good data backup hygiene begins with backup software on each digital device used by each employee, where appropriate, followed by continual, systemwide backup that is sometimes made in duplicate or triplicate.
Some businesses also add data backup to the cloud as another layer of security — which comes in handy if your business is hit by a fire or other property-wrecking catastrophe.
Moreover, extremely adept cybersecurity pros also include “air-gapped” backups — or data backups to devices that are disconnected from the computer network at least once a day.
Safeguard Your Cloud Operations
As businesses increasingly rely on the cloud, it’s critical that they confirm with cloud providers that they have ample cybersecurity throughout their systems.
Cloud security posture management tools, for example, help to continuously monitor cloud environments for any nefarious behavior.
Ensure Your Cybersecurity Protocols Are Compliant
Increasing numbers of government agencies — including, most recently, the U.S. Securities and Exchange Commission — are requiring businesses to have a written cybersecurity plan in place and be able to prove that the cybersecurity plan exhibits due diligence.
You can ensure your business stays in compliance with government regulators by engaging in regular audits performed by your business security team, as well as external audits handled by outside cybersecurity compliance experts.
Businesses can also use automated compliance software to stay on top of their cybersecurity readiness.
Coordinate With Third-Party Partners
Too many businesses have learned the hard way that their state-of-the-art security protection can be easily compromised if a business partner they’re linked to has weak cybersecurity.
Cybercriminals take advantage of this kind of asymmetry by hacking into the smaller partner’s poorly protected network first — then using the IDs, passwords and other data they find there to break into the larger trading partner’s computer network.
The solution: Ensure that you regularly assess your shared security vulnerabilities with all trading partners, and regularly verify that their cybersecurity protections are at least as good as yours.
Crawford
“This goes back to training people and having them ask the right questions at the right time with vendors and third parties as required,” said Artie Crawford, director of cybersecurity at the National Motor Freight Traffic Association.
In fact, some companies go a step further by embedding minimally acceptable cybersecurity practices into the contracts they make with trading partners.
“Verifying the cybersecurity systems of third-party trading partners is absolutely crucial,” said Erika Voss, chief information security officer at DAT Freight & Analytics. “Regularly assessing your partners’ cybersecurity practices, conducting audits, and ensuring they meet industry standards can prevent the spread of malware or fraudulent activities across the supply chain.”
Update and Patch All Software ASAP
Microsoft and similar software goliaths have been lecturing us for decades on the wisdom of installing all updates and software patches the moment those become available — which makes perfect sense.
John Elliott of Load One demonstrates how onboard video combined with AI-enabled analytics can transform fleet safety. Tune in above or by going to RoadSigns.ttnews.com.
Consider: All providers of major software have dedicated teams of IT pros whose entire job is to stay alert for security vulnerabilities and patch those problems the moment they’re caught. Why not profit from all that substantial oversight by installing the security updates and patches those teams release, most of which are freely offered?
You can make that job a bit easier at your business with automated patch management software, which ensures all updates are installed as soon as possible. Some versions of this software will also regularly scan your network to ensure that all your software is up to date.
Implement Advanced Threat Detection and Response
Besides erecting a digital firewall and installing antivirus software, you’ll also want to add endpoint detection and response. These software solutions monitor and defend against hackers trying to infiltrate your network via employee laptops, smartphones and other digital devices.
Evaluate the Pros and Cons of AI Security
While a raft of new AI-powered tools have emerged in the cybersecurity space, you’ll want to carefully look over these tools before embedding them in your computer network.
Granted, AI cybersecurity software can auto-identify unusual activity patterns on your network, such as off-hours logins, logins from users that have not used your network for months, logins from remote locations around the globe that don’t make sense and similar anomalies.
Want more news? Listen to today's daily briefing above or go here for more info
However, AI-powered cybersecurity can also become a headache if it is not trained properly on your system. Plus, such software has also been known to generate false positives, false negatives and other types of inaccurate reports.
The best bet here — if possible — is to slowly introduce any AI-powered cybersecurity software to your business network in a “sandbox” setting, where it can be rigorously studied and evaluated before going live across your computer systems.
Meanwhile, be aware that as you’re evaluating AI tools, so are the hackers.
“AI-generated or AI-assisted identity theft and credential harvesting through typical means of phishing is helping the bad actors craft more believable and more successful campaigns,” NMFTA’s Crawford said.
Create a Cybersecurity Incident Response Team
Sadly, getting hit by a hacker in any given year is now considered by many businesses a mostly inevitable experience.
Savvy businesses have already created incident response teams to leap into action the moment a hack occurs, along with a detailed, step-by-step plan that includes neutralizing the hack’s impact, alerting partners affected by the intrusion and restoring the organization to everyday, safe operations.
Key personnel on your incident response team should include IT staff, lawyers and at least one company expert in public and press relations.
“I firmly believe the most important tactic in fighting this battle is making sure a company can recover when an incident happens,” said Wade Anderson, chief information officer and chief technology officer at Bay & Bay Transportation, which ranks No. 82 on the for-hire TT 100.
Joe Dysart is an internet speaker and business consultant. Voice: (631) 233-9770. Email: joe@customtechadvisor.com. Web: www.dysartnewsfeatures.com.
