Fielding the Costs: The Economic Challenges of Securing Food Sector, Scott Algeier, Food & Ag-ISAC

### Overview In this presentation, Scott Algeier, Executive Director of the Food and Agriculture Information Sharing and Analysis Center (Food & Ag-ISAC) and the IT-ISAC, examines the asymmetric economics of cybersecurity and their direct impact on the food and agriculture critical infrastructure sector. Modern agriculture increasingly incorporates technology to feed larger populations on fewer acres, expanding its overall attack surface. While defenders incur mounting expenses across tooling, staffing, and compliance mandates, cyber adversaries benefit from low operational costs, lucrative payouts, and collaborative networks. Algeier advocates for industry-wide threat intelligence sharing and collaboration through ISACs to pool defense resources and counter threat actors.

### Key Topics - **Formation and Role of the Food & Ag-ISAC**: Launched in May 2023 in partnership with the IT-ISAC (established in 2000), the Food & Ag-ISAC addresses risks spanning "pre-farm to table"—from seed research to consumer distribution. By partnering with IT-ISAC, it leveraged existing infrastructure rather than spending a decade building analytic capabilities independently. - **Economic Asymmetry Between Attackers and Defenders**: Attacking remains cheap, with cybercriminals offering ransomware-as-a-service for as little as $40 per month, malware installation starting around $35, and DDoS tools for modest fees. In contrast, global defense spending reaches $215 billion annually, businesses spend 10–15% of IT budgets on security (~$2,700 per full-time employee), and average breach recovery costs hit $4.88 million in 2024. Despite this spending, global cybercrime damages are estimated at $9.5 trillion in 2024, projected to exceed $10 trillion in 2025. - **Regulatory Pressure and Resource Diversion**: Proliferation of compliance and mandatory incident reporting frameworks (including SEC rules and proposed CISA requirements added to 36 existing federal reporting rules) often diverts fixed security budgets toward legal and compliance overhead, with some firms employing three to four compliance personnel per security defender.

### Technical Details - **Incident Breakdown in Food and Agriculture**: Incident tracking indicates that ransomware accounts for over 53% of observed incidents, followed by nation-state actors at 27%, alongside hacktivists and other cybercriminals. - **Nation-State and APT Threats**: Advanced persistent threat actors prioritize cyber espionage and intellectual property theft. Algeier notes that developing corn seed technology can require $30 to $40 million in laboratory testing over seven years, making R&D a prime target for nation-states (such as China) seeking to bypass domestic R&D costs via network compromise or biological theft. Additionally, nations such as North Korea leverage cyber operations for state funding, while critical infrastructure dependencies (such as power and energy) create operational risks. - **Ransomware Tracking & Metrics**: Food & Ag-ISAC tracks over 6,500 historical ransomware incidents since 2020. In 2023, 167 out of over 3,000 tracked critical infrastructure attacks targeted food and agriculture (5.5%). In the first half of 2024, 80 out of 1,000 critical infrastructure attacks were in food and agriculture (~7%), with overall incidents temporarily dipping due to law enforcement disruptions. While attackers rarely target the sector exclusively, just-in-time delivery supply chains increase pressure to pay higher ransoms once an organization is compromised.

### Takeaways - **Defend Collaboratively**: Because cybercriminals collaborate, share playbooks, and mentor each other, isolated defense is economically unsustainable. Food & Ag-ISAC provides vendor-neutral threat reporting, hunting platforms, and adversary attack playbooks mapped to the MITRE ATT&CK framework across 250+ threat actors. - **Divide and Conquer**: Member enterprises can distribute threat monitoring responsibilities across peer analysts to avoid redundant workloads. - **Voluntary Sharing Outperforms Regulation**: Reporting incidents to government agencies under mandatory compliance rules does not provide operational defense assistance, as federal entities like CISA lack resources to protect individual corporate networks. Voluntary peer collaboration serves as a more practical force multiplier.