Risky Business

Threats to supply chain cybersecurity are at an all-time high. Here’s how to fight them off.

Supply chains don’t just connect end users with products. They connect suppliers with manufacturers and shippers. Increasingly, they connect these different vendors’ computer networks. So, when it comes to supply chain cybersecurity, it’s not enough that one business’ network is secure. If their suppliers are connecting to that network, the suppliers’ networks need to be secure as well.

That lesson was painfully borne out in the 2013 Target data breach when hackers got in through an HVAC company that had remote access to Target’s network. Striking during the busy holiday season, the hackers stole 40 million credit and debit records and 70 million customer records.

Sometimes a breach can be caused by not installing software updates, as was the case with the 2017 Equifax breach. Sometimes, sophisticated attacks can come as a result of a software update, as occurred with the 2020 SolarWinds breach.

However they come, cyberattacks are getting more complex and exploiting more avenues of access. No longer can supply chain cybersecurity be considered an IT-only problem. It’s everybody’s responsibility.

Threats Abound

Threats to supply chain cybersecurity come from all over. One supplier’s poor practices can become a huge problem for all their business partners in a hurry. Open-source software can provide a lot of benefits, but it’s susceptible to bad actors and code vulnerabilities. Supply chain networks often contain multiple tiers and are reliant on clouds. This leaves a lot of potential points of entry for hackers.

These entryways include hackers stealing credentials and logging in successfully with them, as the thieves in the Target breach did. Or they can pretend to be suppliers, with phishing scams that look just legitimate enough to trick someone into clicking on something they shouldn’t before they realize something is not quite right. Once in possession of sensitive data, hackers can hold it for ransom, extorting large sums from affected companies.

In updating its national cybersecurity framework, the National Institute of Standards and Technology highlighted the importance of supply chain risk management added “govern” as a sixth pillar of recommend best practices.

“‘Govern’ really represents the fact that we have to bring this into the boardroom for discussion,” Laurie Locascio, director of NIST and undersecretary of Commerce for Standards and Technology, said. “That took a lot of discussion across all the stakeholders because it is a big change.”

Organizations that fail to make supply chain cybersecurity a top priority will find themselves paying dearly for it in the event of a breach.

Action Items

So, what do those in the boardroom do to protect their supply chains in the digital realm? First, they need to get to know their suppliers in detail. This includes ones they’ve been working with forever and ones that are new partners.

“That means checking that their security program aligns with your expectations and that they have baseline measures in place for threat protection, detection, and response,” We Live Security advises.

Every contract should include basic cybersecurity requirements, the NIST says. Once the vendors are onboarded, IT professionals work with them on-site to shore up any vulnerabilities. Those that don’t live up to the requirements lose their spot in the supply chain. Purchases are made only from approved vendors, a list of whom is distributed throughout the organization so everyone knows who is (and is not) approved.

Users need to be trained across the life cycle for any new software purchases, which should come with the source code. Any legacy products should have authorized IP and capable IT support through the end of their lives. Software and hardware should have a security handshake.

“It is undeniable that software supply chain security requires immediate and bold action to protect software — and hardware — users everywhere,” Purdue University researcher Sabine Brusnwicker, who along with colleague Santiago Torres-Arias received a $200,000 Google grant to work on the growing problem of digital supply chain software attacks.

It’s not a matter of if a supply chain will experience a cyberattack, it’s a matter of when. So leadership needs to take a proactive approach.

“Establish a formal, transparent, risk management program for the supply chain that has policies, processes, accountabilities, and a sufficient budget and staff,” BCG counsels, “determining which systems are critical to ensure accurate reporting of material weaknesses and significant deficiencies associated with third-party risk.”

The role of the chief information security officer has suddenly become one of the most important in the C-suite.

“CISOs must reconceptualize their responsibility matrix to empower Boards of Directors, CEOs, and other business leaders to make their own informed risk decisions,” Gartner research vice president Peter Firstbrook said.

With Gartner projecting that 45% of global organizations will suffer a software supply chain attack by next year – triple the rate from 2021 – it’s time to get serious about supply chain cybersecurity or suffer the consequences.