An often forgotten element of Cyber security is within a company’s supply chain. The threat has been around for awhile now but is starting to become much more prevalent targeting your suppliers as a means to get to you. Manufacturers for instance, often use what is known as ‘just in time supply’, ie they have an electronic connection to their key suppliers who are connected up to the company’s inventory, and automatically resupply when an item runs low. It’s efficient and prevents the holding of unnecessary stock. But it can, if not done correctly, drive a coach and horses through your security.
The goal of such an attack is to grab whatever you have that is of value to the attacker, so it can include infecting legitimate applications in order to distribute malware, access your IPR (designs, plans, source code, build processes etc etc), or inventory theft, inserting false invoicing into your system etc. In fact, if you can think of something that might damage your company, you can bet that the cyber criminals have already thought of it.
In short, a supply chain attack is a cyber-attack that seeks to damage an organisation by targeting less-secure elements in the supply chain.
Many of you may have heard of The SolarWinds Orion data breach. This is a product that is in wide use by network engineers, and in fact, I’ve used it myself as it’s a great way of mapping a network that I’m looking at from a security perspective. This breach not only demonstrated the devastating potential of supply chain attacks, but it also exposed concerning vulnerabilities in conventional defence methods that make such attacks possible.
Small to medium enterprises are at greatest risk from cyber security threats, and their vulnerability in turn poses a danger to the major corporations that they do business with. So said Steven A. Melnyk, Professor of Supply Chain Management at Michigan State University in the United States. He goes on:
“Blockchain is vastly overrated; supply chain cyber security is under rated; and we are not spending enough time on small to medium enterprises. We need to grow them; but they are a challenge in terms of cyber security,” he stated.
“The problem with small to medium sized enterprises is that they are in the unique position of having disproportionate access to important information. They are often mission critical suppliers that produce niche products. They are protected by governmental regulations and requirements. However, they generally have the weakest cybersecurity arrangements in terms of size, resources and expertise. They open up large clients to leapfrog cyber security attacks.”
Melnyk cited the example of a well-respected American chemical company that was hacked through its supply chain. The hackers obtained information about customers and orders, including quotes. They saw details of items that the company – which was renowned for innovation – was getting ready to patent, he revealed. “The hackers altered the master production schedule; they changed due dates, order quantities and order quality levels. Deliveries were compromised. A new supplier then entered the market, with the precise items that the customers wanted, at prices under the current variable costs. This supplier also patented the firm’s innovations.”
The growth of the digital economy and digital supply chain is contributing to the growing cyber security threat, with four billion people predicted to be connected to the Internet daily in 2020. In 2021 it is estimated that so far, attacks of this nature have increased globally, by around 42%.
There are of course things that you can do to protect yourself and your clients. There are a number of technical defences that you can implement. The problem generally remains that SMEs have a tight budget and no internal resource to combat this issue.
The first thing cyberattackers do after breaching a defence is move laterally throughout the ecosystem in search of privileged accounts. This is because privileged accounts are the only accounts that can access sensitive resources. When a privileged account is found, sensitive data access is attempted. This predictable attack sequence is known as the Privileged Pathway - it's the common attack trajectory followed by most cybercriminals. The trick is to disrupt an attacker’s progression along this pathway so that breach attempts, and therefore supply chain attacks, can be prevented.
An effective Privileged Access Management (PAM) framework will disrupt this common attack trajectory and is highly recommended.
That said, I have always been a great advocate that the biggest ‘quick win’ any company can achieve, at minimum cost, is staff awareness. Staff are the primary gateways to malicious code injections because they're usually tricked into permitting cybercriminals access into an ecosystem.
The most common form of trickery is scam emails (or phishing attacks), which I have discussed in previous posts. These emails seem like they're sent from trustworthy colleagues but upon interacting with them, malicious codes are activated and internal login details are stolen, which in turn could grant criminals access to a system, initiating the hunt for higher privileged accounts.
To prevent such incidents, all staff need to be educated about common cyberattack methods so that they can identify and report breach attempts, rather than falling victim to them.
There is so much more to this subject, and it is a matter for each company to assess how much of a problem they think this is to them. Understanding the threats to the business, how vulnerable you are to those threats, and therefore what risks you are taking, and how severe they are, is key to every element of Cyber Security. SMEs remain vulnerable because they rarely have any in house resource to understand those risks, and take the right actions to mitigate those risks. Solutions need to be Affordable, Appropriate and Accreditable, the H2 triple A service. If you want to know more then visit our web site at www.hah2.co.uk.