Supply chain attacks are genuinely a growing threat, making them a legitimate concern for many businesses. A chain reaction, potentially triggered by a successful attack on a single supplier, can jeopardise an entire network of suppliers, and with it the value chain – and your company too. In this article, we are taking a closer look at supply chain attacks, highlighting cyber risk factors and providing tips on how to minimise them.
For digital components like software, virtual platforms and services and data, supply chain risks have significantly increased in recent years, as increasingly sophisticated cyber-attackers are targeting weak points in these digital assets. This is particularly true of OT (Operational Technology) environments like control and monitoring systems, because modern assets are networked, digitised and remotely controlled. According to IBM’s X-Force Threat Intelligence Index 2022, the industrial sector will even be the hardest hit by cyber-attacks in the near future.
A supply chain is basically a means of bringing together an ecosystem of all the resources needed for developing, manufacturing and distributing a product. In cyber security, supply chains primarily include hardware and software, cloud and local storage solutions and IT-based mechanisms for production and distribution.
Initially, supply chain attacks usually target one or more suppliers, with the ultimate target, which is usually customer data or customer assets, only being targeted in a subsequent attack. Therefore, , it can take several months for an attack to be successful. Despite this lengthy time frame, it is common for attackers to remain undetected for very long periods of time. In a similar way to advanced persistence threats (APT attacks), supply chain attacks are usually target-specific, complex and planned well in advance. These factors demonstrate how sophisticated and persistent attackers can be.
As a result, in supply chains the threat landscape is also undergoing constant evolution. That’s why both the second line of defence (2LoD; policy makers) and the first line of defence (1LoD; practitioners) need to have access to accurate, up-to-date information about their own IT and OT environment well as the threat landscape. However, as is so often true, there is the issue of which sources can or should be relied upon with regard to the threat landscape. For example, on 5 May 2022, the National Institute of Standards and Technology (NIST) published guide recommendations for managing cyber security risks in the supply chain entitled «Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations» (C-SCRM). It states that supply chain risk for digital components, in particular, has developed and expanded as a result of complexity, digitalisation, globalisation and virtualisation. All digital components are vulnerable (firmware, software, virtual platforms, services and data), and they can be exposed to supply chain risks originating from a range of different threats, vulnerabilities and impacts.
IT-Increasingly, IT and OT systems are automated, networked, digitised and remotely controlled, for example in smart cities, energy management, logistics, value chains etc. However, the ongoing convergence of IT and OT also increases dependence on digital supply chains, which is why they demand special attention as part of cyber security. This is why all the digital elements in the supply chain should be taken into consideration in order to make a comprehensive assessment:
However, it is no longer enough to put strong security measures in place if attackers have already shifted their attention to suppliers. This is also the conclusion drawn by the European Union Agency for Cybersecurity (ENISA) in a report published this year.
There are, of course, tried and tested measures for minimising the risk of supply chain cyber-attacks. The most important recommendations are summarised below:
It is also recommended for suppliers to adopt best practices for vulnerability and patch management. Key recommendations include:
The introduction of new technical components and architectures, and integrating them, leads to constant changes in architectures – and therefore in risks. Overall, a move towards identity-centric security is taking place. (You can find more about the practical implementation of identity-centred security in this article.
Modern products and services are dependent on their supply chains, which link together a global network of manufacturers, software developers and other managed service providers (MSPs) or service providers. When considering security risks with MSPs, the focus is on service providers who have access to facilities, systems or data. Again, there are some basic rules and practices that should be followed to minimise cyber risks. These include keeping a record of managed services and periodic security assessments of cloud services and who provides them.
The obligation to protect data is no different when using a managed service or a cloud service than when using an internal service. Therefore, contractual agreements between providers and customers should address the way in which security risks are managed. However, it may also be the case that managed or cloud services are or have to be used before all security requirements have been implemented by a provider. Here, the contractual agreements should include suitable deadlines for implementing security requirements and exit clauses, should these not be met.
Other points it is advisable to include in a contract:
There will be an increase in the remote operation of interconnected IT/OT systems. Both companies and manufacturers that supply digital components for factories have been working intensively for several years to interconnect the systems, and thereby operate them remotely. This is accompanied by a growing security risk. To make matters worse, the supply chain risk for digital components is constantly evolving and growing due to increasing globalisation and complexity, digitalisation and virtualisation.
All this makes my plea to you is even stronger – you must build resilience into the extended supply chain, deal proactively with cyber threats, ensure compliance and secure procurement. This is because, as I explained at the start, a successful attack within the supply chain – even if it is “only” on an indirect partner – is enough to put your company at risk too.
Do you need assistance with assessing and optimising your cyber security with respect to supply chains?
You can find an overview of our services on the topic of Cyber Supply Chain Risk Management. Or contact us! I and my colleagues will be happy to advise you on all aspects.