Cyber Resilience

The methods of attack by hackers keep expanding, supply chain cyber attacks being one of the most recent that are presenting a major threat to businesses. So, what are supply chain attacks and how can businesses secure against them? Let’s start with what and go from there. 

What are supply chain cyber attacks 

Supply chain cyber attacks are supply chains that are targeted for cyber criminals to infiltrate. Supply chain cyber attacks can come from many sources including supply chain partners, supply chain manufacturers, supply chain shippers and supply chain brokers. What makes a supply chain attack unique is the use of malware in all or part of the supply chain network and supply process to steal intellectual property, trade secrets or other sensitive information stored on computers within the supply network. 

A supply chain cyber attack may occur at any point during a supply process where there is a computer connected to the public internet. The variety of methods that hackers deploy their malware give them great flexibility in choosing how they want to attack the target supply networks. Just take as an example the latest supply chain cyber attacks – Kaseya and SolarWinds. 

Examples of what supply chain cyber attacks look like 

When hackers attacked Kaseya, a software company that sells IT management software – tools for monitoring and controlling what happens on a computer network, they infected the cybersecurity managed service providers that use the Kaseya software to provide “managed services” to small and medium-sized businesses. The hackers encrypted the victims’ data and shut down the computer networks. They asked for a $50 million ransom to unlock the networks. 

The SolarWinds attack, also a company that sells software to help businesses monitor their computer networks, took place with a virus that was able to get in through a routine software update. Once the breach took place, the virus allowed hackers to monitor and control the computer networks of 100 private companies and nine US government agencies that used the SolarWinds software. There is still the potential that hackers are exploiting the vulnerability. 

Lastly, the same group that conducted the SolarWinds attack, also breached Microsoft’s software. However, in this case, the hackers failed to reach Microsoft’s customers, but it revealed just how dangerous supply chain cyber attacks can be for all businesses, large and small. 

How to secure against supply chain cyber attacks 

The ideal supply chain cybersecurity steps involve a holistic approach that covers all your bases for protecting against external threats and vulnerabilities from supply chain partners. The goal is to prevent unauthorized access, data theft, and interruption of service. 

Cyber readiness is achieved by implementing measures to protect the supply chain’s IT systems such as implementing two-factor authentication, data encryption, data purging, DLP policies and training users on cybersecurity standards.  

Furthermore, you want to train employees on all cybersecurity aspects and not only how to safeguard from phishing email attacks. So, investing in micro-learning cybersecurity training for employees is also ideal. 

In addition to your IT systems and employees, vetting your supply chain partners and their cybersecurity hygiene, as well as implementing policies and procedures. 

Lastly, incident response and business continuity plans are important to establish on your end and to verify your supply chain partners’ IR and BC plans. 

Supply chain cyber attacks are becoming more prevalent with each passing day. They can be extremely costly for supply chains, and the losses incurred by supply chain cyber-attacks have been estimated to total $2 trillion globally in 2017 alone.  

Protect your business against supply chain cyber attacks by following the simple best practices that we’ve outlined above and always ensure that you implement a cybersecurity plan that is appropriate for your business in addition to training employees on how to spot potential supply chain threats when they come across them, monitoring all devices connected to networks and the use of policies and procedures for BYOD, as well as having the necessary tools to monitor your hybrid and remote work network activities at different times of the day or week to identify abnormalities. 

Last but not least, stay up to date on cybersecurity news and reach out if you need our support for your company’s cyber resilience. 

We have cybersecurity awareness training. Start for free here: https://training.ncxgroup.com/free/  

We have a free cyber ready consultation available with our cybersecurity experts that you can book. Schedule a time here: https://calendly.com/ncxgroup

Photo courtesy of pedrosek