Moderna, Pfizer, and most recently Johnson & Johnson vaccines have received Emergency Use Authorization from the U.S. Food and Drug Administration (FDA), while AstraZeneca plans to submit its vaccine to the agency soon.for review.。

This means multiple vaccines will have different supply chains and global distribution networks, ultimately reaching various vaccination sites.

"In isolation, we are not dealing with extremely complex problems," said Simon Geale, senior vice president of client solutions at Proxima, a procurement specialist. "But when you layer all the elements together, you end up with one of the most complex operations you have ever seen, and each country's situation is different."

This operational complexity means the pharmaceutical industry is struggling to deal with hacker attacks and counterfeit products. Last summer, the U.S. Department of Justice accused hackers in China and Russia of trying to steal COVID-19 vaccine research results.

"We are laying track in front of the train," Geale added, with supply chains being built so quickly that the industry focuses more on monitoring than prevention. "We are operating in an unknown environment, so vulnerabilities are emerging around us."

The United States has a mature vaccine supply chain, but the COVID-19 vaccine supply chain is different. Parties including vaccine manufacturers, distributors, federal, state, and county governments, and vaccination sites may not have experience working together before.

Technologies such as artificial intelligence, automation, collaboration tools, and blockchain can help by building trust, providing a single version of truth, enhancing security, and reducing the possibility of fraud.

Four types of tools to combat cybersecurity and counterfeiting issues

Geale said the COVID-19 vaccine has become the most valuable commodity on Earth.

Duncan Greatwood, CEO of IoT security company Xage Security, noted that so far, vaccine research and early production stages have been the primary targets for governments and independent attackers seeking to steal intellectual property. He also worries about cybercriminals launching ransomware attacks or sabotaging vaccines by altering storage temperatures.

Geale believes that handling vaccine security is not fundamentally different from other industries.

"At the highest level, the basic principles are the same," Geale said. This means building security-first systems, adopting cloud strategies, protecting system management tools, and strengthening identity and access management.

1. Zero Trust Strategy

Xage adopts a zero-trust approach, which means not trusting any entity or individual by default without proper permissions and authentication.

Greatwood said that people working for pharmaceutical companies or with access to laboratories do not need full access to the entire system.

"You have to prove your identity and confirm you belong to the (authorized) member group," he said. This also applies in distribution systems.

Greatwood said production data is typically encrypted and signed at the point of production. Xage provides API security services that control access to data. The API is then used for verification and electronic signature cross-checking, such as ensuring the signature matches the one on the temperature sensor software component.

"We are operating in an unknown environment, so vulnerabilities are emerging around us."

—Simon Geale, Senior Vice President of Client Solutions at Proxima

A zero-trust system requires policies that define who (or which machines) are allowed to access specific data.

He mentioned that in the past, in production environments, a machine might be allowed to communicate with any other machine. A single hacker attack could mean that machine infects others. With restrictive policies, when a machine or person attempts to access without authorization, the system generates alerts and blocks the spread of the attack, helping to prevent problems on the production floor.

Transitioning from implicit trust to a zero-trust solution may require multiple steps and may involve adding software or hardware, and related policies and processes also need to change.

"When you give anyone access to everything, you don't need policies," Greatwood said.

2. Real-Time Visibility and Tracking

David Parker, chief evangelist at IoT sensor and visibility company Cloudleaf, said data loggers are old technology; they can tell companies where a truck is but not the condition of the cargo inside.

Parker said real-time data trackers are like equipping each shipment with a mobile device. The device shares the product's location information with relevant parties monitoring on a software platform, ensuring quality insights.

Meanwhile, sensors continuously provide temperature readings, which are crucial forvaccine logistics requiring specific temperatures.Some sensors also share information about shock, vibration, and ambient light detection. Parker said if a trailer door opens at an unexpected time, sensors can share information in real time, sending email or SMS alerts, or even notifying law enforcement to intercept the shipment if programmed to do so.

Parker said that due to the COVID-19 pandemic, the adoption ofhigher-level tracking devicesthat can be placed on pallets, boxes, or individual vaccine vials has accelerated by two to three years.

"Everyone is talking about digital transformation, but they were still in the thinking and discovery phase, considering design and implementation. This has all been accelerated," he said.

Algorithms determine the best delivery route based on the criticality of the journey and customer preferences. Shipments (even down to the item level) are tracked from origin to destination, including routes and waypoints.

Parker said if a carrier deviates from the designated route, or if doors open or close at unexpected times, the system alerts. If a shipment takes an unexpected route, Cloudleaf or the customer may question the carrier about the unfamiliar shipping pattern and may suggest pausing future shipments until more is understood, helping prevent theft and other issues.

Visibility and alert systems can also save other costs. Parker mentioned that last year a client had vaccine shipments worth $8 million to $10 million each, and they placed an empty trailer behind the main transport vehicle in case the main vehicle broke down.

"Given the technology we implemented for them, they no longer need the second trailer because they have full visibility," Parker said.

Tracking data may not be available 100% of the time. If wireless communication and cloud uploads are unavailable, sensors can store information and transmit when communication is restored. This can be difficult if sensors are in low-connectivity areas.

3. No Single Point of Access

Xage recommends a distributed ledger approach to collect and store information, including passwords. If a person or software attempts to use false data, thousands of other nodes will reject it.

"Distributed ledgers are a powerful data structure for handling multi-party interactions," Greatwood said.

IBM has two blockchain-based products: the Vaccine Accountability Network and the Digital Health Pass. The Vaccine Accountability Network is a platform connecting the entire supply chain from manufacturers to vaccination sites.

Vaccination staff can scan vials to view production dates, temperatures in the supply chain, and verify storage temperatures at the vaccination site. If the vaccine is fine, a green checkmark appears. Jonathan Wright, global leader for IBM's supply chain business transformation services, said this information can be transmitted to a health pass app on a smartphone, giving the vaccinated person proof of vaccination.

This blockchain technology aids recalls by identifying where affected vaccine batches went.

"The underlying technology manages the risk of ensuring no counterfeits, ensuring we build trust, and creating a platform where all parties can use data simultaneously," Wright said. He added that the data already exists, and the platform provides a single version of truth.

The Vaccine Accountability Network has been tested on other pharmaceuticals in a collaboration involving IBM, KPMG, Walmart, and Merck. IBM is ready to pilot it for COVID-19 vaccines.

Wright said that in the first wave of vaccine distribution, there was no time to build such a solution; the goal was to vaccinate as quickly as possible. In the next phase, the focus will shift more to the vaccine recipient's experience, ensuring they are more comfortable with the process. Then, when vaccination is no longer so urgent, efforts will be made to add value.

4. Digital Authentication and Serialization

Greatwood said forged data is a common component of cyberattacks and counterfeit products.

"Attackers want victims to believe everything is normal," he said, such as providing false temperatures or replacing vaccine information. "Data integrity is critical at every stage of the vaccine system."

When implementing security and enforcement systems, Xage inserts software code at the point where data is generated (such as at temperature sensors) so that data can be signed with digital certificates and mapped to fixed values.

Parker said pharmaceutical companies include batch and lot number identifiers when serializing their products. This information is encoded in smart labels or sensors attached to vials. If someone tampers with a vial, altering the serialization information, it indicates the product may be counterfeit.

"Data integrity is critical at every stage of the vaccine system."

—Duncan Greatwood, CEO of Xage Security

Parker noted that serialization alone is not a complete solution because real serial numbers can be used on counterfeit products. Digital authentication and viewing the chain of ownership help address this issue.

Greatwood said most pharmaceutical companies already have some security measures in place; "few are just relying on luck." However, he added that most companies still have significant issues with assumed or implicit trust, where people are granted more access than necessary.

Implementing new security measures is often rolled out in phases across the supply chain, for example, first on the production floor, then in laboratory facilities, then in the distribution chain. The specific order may vary based on a company's priorities and existing security efforts, which involves developing or understanding current security policies.