Every vehicle in our fleet reports its position every thirty seconds. The portal that displays those positions was bought by the fleet team in 2018 to help planners find vehicles, and it does that well. It also shows what each trailer is carrying, whether it is loaded, and where it has stopped overnight.
In the spring a trailer of televisions was emptied in a motorway services car park while the driver slept. The loss adjuster asked who could have known the trailer was there, and we did not know. The portal had three hundred and forty accounts. About ninety belonged to planners and managers who needed them. The rest had been created over the years for customers following their own deliveries, for subcontracted hauliers, for a consultancy that studied our routing in 2021, and for staff who had since moved roles. Customer access was not limited to that customer's loads, because the portal's permissions worked by depot, and several large customers had been given a whole depot so that their orders would appear.
I cannot say the portal was used. The police thought it more likely the vehicle had been followed from the depot. But no single field in that portal would have worried anybody. A position is routine, a load description is routine, and so is a stop. Together, live, they answered the three questions a thief needs answered, and we had handed that answer to people whose names we could not produce, with passwords that had never changed and no second factor.
The portal now signs in through the same identity service as everything else, with a second factor, and accounts lapse when a person leaves or a contract ends. Customers see only their own consignments, shown as a status and an estimated arrival rather than a pin on a map. Subcontractors see their own vehicles. Positions of high value loads are delayed by an hour for everybody outside the planning team, which the planners accepted once they understood why. Fleet and my security lead review the account list together each quarter.
Two hundred and six accounts were closed in the first week, and three people asked for theirs back.
We had classified the data one field at a time and found nothing sensitive. The risk was in the combination, and the combination was the whole point of the screen.
– Serguey Shinder
