While the global supply chain has only recently fallen into crisis, the digital supply chain has been under stress for years.
       
According to a recent survey of 1,200 security leaders across a dozen industries, over 90% of organizations have suffered a security breach due to vulnerabilities in their supply chain. Pair this with the fact that the average vendor ecosystem now includes over 3,700 companies (up from 1,013 in 2020), and it's no surprise that supply chain cyberattacks have quadrupled in the last year alone.

No matter how secure your company may be, there's still a very high likelihood that you'll suffer a security breach through no fault of your own, and this trend will continue unabated until large-scale supply chain reforms are implemented.

Until then, here are three key digital supply chain risks along with proven policies to help you mitigate them:

A Vulnerable Vendor

Take Kaseya Software as an example. Kaseya is a relatively small IT management firm that's based in southern Florida. However, when they were hacked just before the July 4th weekend, the fallout was felt around the world. 1000s of downstream companies, from a Swedish grocery chain to schools in New Zealand and IT providers in Germany, were forced to halt operations.

What could these organizations have done to protect themselves from falling victim to a vendor breach? How can companies in general secure themselves in an environment over which they have limited to zero control?

A good place to start is by identifying key vendors – those with access to sensitive data or who are crucial to everyday operations – and then conducting cyber due diligence. Preferably, this should take place before any contract is signed or systems are set up. Moreover, it's always good practice to stipulate liability in case of any cyber-events.

Depending on your company's needs and resources, consider engaging an outside cybersecurity partner to perform cyber due diligence or run an independent risk assessment on mission-critical partners.

Finally, automated solutions, like continuous monitoring or attack surface management, can augment your manual efforts and spot any weak links as soon as they arise. For cloud service providers, make sure that you have access to control mechanisms like session monitoring, point of entry, and auditing capabilities.

A Vulnerable Up-Stream Partner

In the best-case scenario, you'll be able to audit and/or monitor all of your direct partners. But what about their partners? Remember, the Kaseya breach didn't just compromise their own customers; it spread to companies that had never even heard of them and had no idea that their own vendors were relying on Kaseya's services.

How can you protect yourself from the unknown?

Once again, employing a policy of suspicion can go a long way in limiting your attack surface and mitigating even unknown risks. Start by requiring secure access to all of your resources. Each time a user requests access, require reauthentication. In other words, treat each access attempt as a threat until proven otherwise.

Even once access is granted, ensure that this only includes minimal rights. Only provide data on a need-to-know basis, and default to read-only permissions. This is akin to throwing up roadblocks along a potential attacker's route.

Finally, record your system logs and analyze any anomalies. This will help prevent attacks from unfolding, as well as assist in any post-incident forensics.

Phishing Emails

Phishing emails are by far the most common and successful route for attackers. And increasingly, attackers will pose as a legitimate third-party vendor. According to a recent estimate by the World Economic Forum, 70% of sales representatives still fall prey to phishing emails during attack simulations.

While automated tools can lend a hand here, it's important to introduce cyber-awareness into the company culture. Fortunately, the WEF found a 9-fold reduction in successful phishing attacks once a company began conducting regular phishing drills.

In summary: Over-protective policies are critical to securing your company as well as stabilizing the overall digital supply chain. At a moment when the attackers seem to have the advantage, transitioning your systems, policies, and culture to security-first approach is the best way to build a secure and resilient digital supply chain.

Talk with one of our representatives today to learn more about how we can help improve your supply chain security.

Similar Reads:
How the Dark Web Can Protect Your Company
An Introduction to Next-Gen Penetration Testing
Blockchain Security: A Brief Overview