Cyber risk management is complex. In the past year alone, our layers of defense stopped over 2 million pieces of malware from reaching Union Pacific (UP) devices. Our team of cybersecurity experts analyzes vast amounts of data, monitoring 30,000 alerts and conducting 500 deep-dive investigations annually. The result? No successful malware incidents in over seven years.
As head of UP’s information security and disaster recovery programs, my journey began in 1997 after five years in technology audits. Everywhere I looked, I saw opportunities for improvement. That’s when Rich Grunwald, then Vice President of Technology, pulled me aside and said, “I’m tired of reading your reports. Come fix the problems.” Twenty-eight years later, I’m still at it.
With countless malicious actors constantly probing for weaknesses, we must be exceptionally skilled at identifying and stopping them. This level of vigilance has its trade-offs. Employees sometimes get frustrated when denied access to installing software or accessing blocked websites. While some see us as the “department of no,” our job isn’t to hinder access but to shield employees and the company from threats.
Cyberattacks aren’t just a Tech Department issue; they pose real risks to train operations, financial security and sensitive data. Threat intelligence reports for 2024 indicate that global attacks have surged 30% year over year, and AI-driven threats are becoming increasingly sophisticated. The pressure to stay ahead has never been greater.
Our top priority is keeping UP’s operations secure. We do this by proactively identifying threats and implementing preventative mitigations, investing in advanced detection capabilities and continuously preparing for worst-case scenarios. We conduct simulated cyberattacks to test system resilience and assess financial impacts. Additionally, a select internal team—unbeknownst to the rest—routinely attempts to breach our own systems to keep our defenses sharp.
Cybersecurity is a never-ending challenge, but our commitment remains unwavering. By staying proactive and adaptive, we ensure UP’s network remains one of the most secure in the industry—protecting our employees, customers and the U.S. supply chain every day.
This article first appeared on the Inside Track section of the UP website.
