Cyber-Biosecurity Risk Perceptions in the Biotech Sector

Abstract

The expanding digitization of the biological sciences places greater value on the data generated, information extrapolated and knowledge gained. Failing to protect data will affect a company or country's ability to position itself optimally in the forthcoming fourth industrial revolution. Further, more reliance on automation, distribution, and outsourcing in biotechnology makes its infrastructure a target. The equipment and service providers that drive physical research and development are also all connected online. Failing to protect these resources from intrusion increases the risk of accidental or deliberate harm, for example by the loss of control over biological products. Robust cybersecurity measures are therefore critical for both securing the data generated by the biotechnology sector as well as securing key infrastructure. Cyber-biosecurity is emerging multidisciplinary field that combines cybersecurity, biosecurity, and cyber-physical security as relates to biological systems (Murch et al., 2018 ). To better identify the perceived risks at the interface between cybersecurity and biosecurity, Biosecure conducted a pilot study that surveyed the opinions of a discrete set of international field leaders in biotechnology and cybersecurity. The survey was carried out online from October-November 2017. Key findings of the survey showed that cyber-biosecurity risks were considered to be difficult to characterize due to variations in types of threats, targets and potential impacts, and compounded by a notable variation between the level of sophistication or maturity of mitigation and response measures. Further research is therefore necessary bringing together the different communities focusing on these issues to develop a common language, better define the threats and discuss potential ways forward in addressing risks.

Facing the 2020 pandemic: What does cyberbiosecurity want us to know to safeguard the future?

“…Nonetheless, cyberbiosecurity is still in its infancy. There is still limited expertise to fully characterize and assess the emerging cyberbio risks [ 8 ], and it has been recognized that generic cyber and information security measures are insufficient [ [8] , [9] , [10] , [11] , [12] , [13] , [14] ].…”

“…Yet, people in the life-sciences are largely ignorant of the dangers as they are barely trained in security issues - or not at all. Research and healthcare industries are vulnerable to cyberbiosecurity attacks because they have not kept up with threats [ 8 , 27 ].…”

“…As with all areas which are converging, expertise is usually very hard to come by (see also Table 1 ). A very recent study that researched the opinion of international field leaders in biotechnology and cybersecurity concluded that “[t]he issue of cyberbiosecurity is not well-known or understood, even among biotechnology and cybersecurity experts” and “Biotech does not think about security other than more traditional biosecurity and biosafety... security communities do not understand biotech” [ 8 ]. This is compounded by the fact that “Extant legislation addressing cyber- and biological risks lags behind technological advances in these fields and cannot be depended upon to address combined cyberbiological threats, vulnerabilities, and consequences” [ 11 ].…”

“…While in some situations certain hazard analysis systems and risk scales have proven useful (e.g. the Hazard Analysis Control Point system for the Fd + Ag sector or, more generally, The Infrastructure Survey Tool [ 36 ] or NIST guidelines [ 37 ]), it is recognized that fully scoping all the cyberbio risks, not to mention their relative likelihood and impact, is rather challenging [ 8 , 22 , 23 ]. Although some of the cyberbio vulnerabilities share compelling similarities to the early days of the internet [ 38 ], there are critical differences [ [9] , [10] , [11] , [12] , 14 ].…”

Genetic information insecurity as state of the art

“…Despite this recognition, proper measures to protect genetic information are often lacking under current best practices in relevant industries and stakeholders. Multi-stakeholder involvement and improved understanding of the security risks to biotechnology are required in order to develop appropriate countermeasures (Millett et al, 2019). Towards these goals, this paper expands upon a microbiological genetic information system assessment by Fayans et al (Fayans et al, 2020) to include a broader range of genetic information, as well as novel concepts and additional threats to the ecosystem.…”