Melanie Padron is vice president of strategic growth at IT ArchiTeks, a provider of IT and cybersecurity solutions to organizations across the transportation industry and others. She sat on a panel about AI and cybersecurity that I moderated at the Trimble Insight conference at the end of September.
One of her big takeaways for the audience, which was primarily made up of carriers, was the importance of vendor vetting because trucking runs on partnerships, and every vendor connects to a company’s data.
“Your vendor’s breach is your downtime; their exposure is your liability,” Melanie said, noting that the National Motor Freight Traffic Association (NMFTA) offers a free vendor vetting framework on their website that she coaches all of her clients on.
One carrier representative in the audience asked for the name of the organization again during the Q&A portion of the panel, and others approached us post discussion to ask about NMFTA again. CCJ regularly covers the NMFTA and publishes content written by the nonprofit’s Chief Operations and Technical Officer Joe Ohr, so I was surprised so many carriers aren’t aware of the organization and what it does.
The trade association’s mission is to ensure consistent, efficient and safe freight movement across North America. It does so by defining and maintaining the LTL freight classification standards through the National Motor Freight Classification (NMFC) system. It also assigns and manages codes like the Standard Carrier Alpha Code (SCAC) and Standard Point Location Code (SPLC) to streamline data accuracy and interoperability. Additionally, it creates open application programming interface (API) standards for carriers, shippers and technology partners.
What I’m most familiar with is the NMFTA’s advocacy for cybersecurity in the trucking industry to prevent freight fraud and larger supply chain disruptions.
Trimble’s conference ended the day the NMFTA Cybersecurity Conference began, and Melanie and I were both traveling from San Diego up to Long Beach to attend.
Using NMFTA resources
As Melanie mentioned, the NMFTA offers a free vendor vetting framework. It also offers many other cybersecurity resources for fleets, including but not limited to a cybersecurity AI governance framework. That’s one of several things the NMFTA finished developing over the past year, said NMFTA Director of Cybersecurity Ben Wilkens during an update on the goings on at the organization.
He said NMFTA has been focusing on the impact of AI on the trucking industry and how to protect against both external AI-enabled threats and potential negative impacts from AI tools that companies may roll out at speed before they’re fully secure.
Melanie noted in the Trimble panel that many trucking companies are adopting AI without readiness: employee training, governance policies and vendor vetting. That’s where both NMFTA vendor vetting and cybersecurity AI governance frameworks can come in handy.
Todd Florence, CIO at Estes Express Lines, warned during the NMFTA panel on the state of the industry that advances in technology, including AI, have accelerated cyber risk.
“You've got lots of new capabilities in the space. The attack surfaces have gotten bigger. The threat actors have gotten more sophisticated. They've gotten faster,” Florence said, but he also noted that the industry has gotten better at collaborating to improve prevention. “We talk about it more openly. Remember how shocked everybody was that we went public about a ransomware attack. I think there's a lot more openness … to acknowledge it's a real thing.
“The more of that stuff that we can share as a as an industry, the stronger we all are,” he added.
Sharing intelligence
The NMFTA has also created the Threat Report Portal in the past year to enable companies to share that information. It gives the industry a place to report incidents, share intelligence and gain earlier visibility into emerging risks.
Ohr said the portal also helps the NMFTA in updating its frameworks and guidebooks, and that’s something NMFTA Cybersecurity Engineer Ken Keskett is working on over the next year.
Keskett noted that many of those resources were developed before the AI boom, so he will be revising them to ensure applicability as cybersecurity threats evolve.
“In the development of these originally, we didn't include artificial intelligence controls. That has to be addressed,” he said.
Keskett said he is planning to bring NMFTA’s frameworks together to create a unified cybersecurity certification framework that carriers and brokers of any size can adopt and receive a “Good Housekeeping Seal,” or statement of assurance, that recognizes a company’s cybersecurity practices comply with NMFTA standards.
He invited carriers to provide input during the process.
“What would be the thing — if you could convince your CISO or CEO to do it — that we should highlight within these frameworks so that certification isn't just a pretty looking stamp,” Keskett said.
