Moderna, Pfizer, and most recently Johnson & Johnson vaccines have received Emergency Use Authorization from the U.S. Food and Drug Administration (FDA), while AstraZeneca plans to submit its vaccine to the agency in the near future.for review.。

This means multiple vaccines will have different supply chains and global distribution networks, ultimately reaching a variety of distinct vaccination sites.

"In isolation, we are not dealing with extremely complex problems," said Simon Geale, Senior Vice President of Client Solutions at Proxima, a procurement specialist firm. "But when you layer all the elements together, you are facing one of the most complex operating systems ever seen, and each country's situation is different."

The complexity of operations means the pharmaceutical industry is playing "whack-a-mole" to guard against hacker attacks and counterfeiting. Last summer, the U.S. Department of Justice accused hackers in China and Russia of attempting to steal COVID-19 vaccine research.

"We are laying the tracks in front of the train," Geale added, noting that the supply chain is being built so quickly that the industry currently focuses on monitoring rather than prevention. "We are operating in an unknown environment, so vulnerabilities are constantly emerging around us."

The United States has a mature vaccine supply chain, but the COVID-19 vaccine supply chain is different. Parties including vaccine manufacturers, distributors, federal, state, and county governments, and vaccination sites may not have collaborated before.

Technologies such as artificial intelligence, automation, collaboration tools, and blockchain can help by building trust, providing a single version of the truth, enhancing security, and reducing the possibility of fraud.

Four tools against cyberattacks and counterfeiting

Geale said the COVID-19 vaccine has become the most valuable commodity on Earth.

Duncan Greatwood, CEO of IoT security company Xage Security, noted that so far, vaccine research and early production stages have been the primary targets for government and independent attackers seeking to steal intellectual property. He also worries about cybercriminals launching ransomware attacks or sabotaging vaccines by altering storage temperatures.

According to Geale, the approach to vaccine security is not fundamentally different from other industries.

"At the highest level, the basic principles are the same," Geale said. This means building security-first design systems, adopting cloud strategies, protecting system management tools, and strengthening identity and access management.

1. Zero Trust Strategy

Xage employs a zero-trust approach. This approach assumes that no entity or individual should be trusted without proper permissions and verified identity.

Greatwood said that people working for pharmaceutical companies or authorized to access laboratories do not need full access to the entire system.

"You have to prove who you are and that you are part of the (authorized) group," he said. The same applies in the distribution system.

Greatwood said production data is typically encrypted and signed at the point of production. Xage's API security service provides access control over the data. The API is then used for verification and electronic signature cross-checking, for example, ensuring the signature matches the one on the temperature sensor software component.

A zero-trust system requires policies that define which people or machines are allowed to access specific data.

"We are operating in an unknown environment, so vulnerabilities are constantly emerging around us."

c26dbb7f8ae5524841267a35b6468bcbecf9efd7dcf6efba56bf278ef43ecb45.png

Simon Geale

Senior Vice President of Client Solutions at Proxima

Previously, in a production environment, a machine might be allowed to communicate with any other machine, he said. A hacker attack meant that machine could infect other devices. With restrictive policies, when a machine or human attempts access without authorization, the system generates an alert and prevents the attack from spreading. This helps prevent problems on the production floor.

Transitioning from implicit trust to a zero-trust solution may require multiple steps and may involve adding software or hardware. Related policies and processes also need to change.

"When you give anyone access to everything, you don't need policies," Greatwood said.

2. Real-Time Visibility and Tracking

Data loggers are old technology, said David Parker, Chief Evangelist at IoT sensor and visibility company Cloudleaf. They can tell a company where a truck is, but not where the cargo inside is.

Parker said real-time data trackers are like equipping each shipment with a mobile device. The device shares product location information with parties monitoring on a software platform, ensuring quality insights.

Meanwhile, sensors continuously provide temperature readings, which are crucial forvaccine logistics requiring specific temperatures. Some sensors also share information about shock, vibration, and ambient light detection. Parker said if a trailer door opens at an unexpected time, sensors can share information in real time, send email or SMS alerts, or even, if programmed, notify law enforcement to intercept the shipment.

Parker said that due to the COVID-19 pandemic,the adoption of more advanced tracking devices(which can be placed on pallets, boxes, or individual vaccine vials) has accelerated by two to three years.

"Everyone was talking about digital transformation, but they were still in the thinking and exploration stage, considering design and implementation. All of that has been fast-tracked," he said.

Supply chain distributing hundreds of millions of vaccine doses

Number of vaccines delivered and administered in the U.S.

Algorithms determine the optimal delivery route based on shipment criticality and customer preferences. Goods (even down to the item level) are tracked from origin to destination, including routes and waypoints.

Parker said if a carrier deviates from the designated route, or doors open or close at unexpected times, the system will issue an alert. Cloudleaf or the customer may question the carrier about unusual driving patterns, and if the shipment deviates from the expected route, they may suggest pausing further shipments until more is understood. This helps prevent theft and other issues.

Visibility and alert systems can also save other costs. Parker mentioned that last year, a client with shipments valued at $8 million to $10 million per batch arranged for an empty trailer to follow the main transport vehicle in case the primary vehicle broke down.

"Given the technology we implemented for them, they no longer need a second trailer because they have full visibility," Parker said.

Tracking data may not be available 100% of the time. If wireless communication and cloud uploads are unavailable, sensors can store information and transmit it when communication is restored. This can be difficult if sensors are in low-connectivity areas.

3. No Single Point of Access

Xage recommends a distributed ledger approach to collect and store information, including passwords. If someone or software attempts to use false data, thousands of other nodes will reject it.

"Distributed ledgers are a powerful data structure for handling multi-party interactions," Greatwood said.

IBM has two blockchain-based products: the Vaccine Accountability Network and the Digital Health Pass. The Vaccine Accountability Network is a platform connecting the entire supply chain from manufacturers to vaccination sites.

Vaccination staff can scan a vial to view production dates, temperature records in the supply chain, and verify storage temperatures at the vaccination site. If the vaccine is fine, a green checkmark appears. This information can be transmitted to a health pass app on a smartphone, giving the vaccinated person proof of vaccination, said Jonathan Wright, Global Leader of Supply Chain for IBM Business Transformation Services.

Temperature deviations cost healthcare transporters $34 billion annually

Costs (in billions of dollars) from medical products exposed to temperatures outside the recommended range

The blockchain technology can play a role in recalls, identifying where affected vaccine batches went.

"The underlying technology manages the risk of ensuring no counterfeits, ensuring we have trust, and creating a platform where all parties can use data simultaneously," Wright said. The data already exists, Wright said, and the platform provides a single version of the truth.

The Vaccine Accountability Network was tested on other pharmaceuticals in a collaboration between IBM, KPMG, Walmart, and Merck. IBM is ready to pilot it for COVID-19 vaccines.

Wright said that in the first wave of vaccine distribution, there was no time to build such a solution. The goal was to get vaccinated as quickly as possible. In the next phase, the focus will shift more to the vaccine recipient experience, ensuring they feel more comfortable with the process. At that point, when vaccination is no longer so urgent, efforts will be made to add value.

4. Digital Authentication and Serialization

Greatwood said forged data is a common component of cyberattacks and counterfeiting.

"Attackers want victims to believe everything is normal," he said, such as providing false temperatures or substituting vaccine information. "Data integrity is critical at every stage of the vaccine system."

When implementing security and enforcement systems, Xage inserts software code at the point of data production, such as at temperature sensors, so data can be signed with digital certificates and mapped to fixed values.

Parker said pharmaceutical companies include batch and lot identifiers when serializing their products. This information is encoded in smart labels or sensors attached to vials. If someone tampers with a vial and changes the serialization information, it indicates the product may be counterfeit.

"Data integrity is critical at every stage of the vaccine system."

c26dbb7f8ae5524841267a35b6468bcbecf9efd7dcf6efba56bf278ef43ecb45.png

Duncan Greatwood

CEO of Xage Security

Parker said serialization alone is not a complete solution because real serial numbers can be used on counterfeit products. Digital authentication and viewing the chain of ownership help address this issue.

Greatwood said most pharmaceutical companies already have some security measures in place. "Few are just hoping for good luck." However, most companies still have significant issues around assumed or implicit trust, where people are granted more access than necessary.

New security measures are typically implemented in stages across the supply chain, for example, first on the production floor, then in laboratory facilities, and then in the distribution chain. The specific order may vary based on company priorities and existing security efforts. This involves defining or understanding current security policies.