The Context

There is a proverb: “If you pull the ear, the head follows you automatically.”

Hacktivists, rogue nation states, and organized cyber criminals are adopting this policy extensively nowadays. In order to hurt any organization, cybercriminals target supply chains.

In the era of globalization and digitalization, organizations of all shapes and sizes depend a lot on their supply chains. However, when global chains are impacted by zero-day attacks, advanced persistent threats (APT), data exfiltration, ransomware, malware, insider attacks, and social engineering, among other types of cybercrime, the targeted organization is brought to its knees.

Consider mobile phone manufacturing vendors. If they suffer from an inconsistent or inadequate supply of chips and other hardware components, the production of mobile phones and their output will be dramatically impacted.

Similarly, an automobile manufacturer is dependent on the suppliers of vehicle body parts, tyres, etc. If a cyber incident occurs at any of the suppliers’ manufacturing units, the automobile manufacturing company will be forced to delay production. Eventually, it affects the business temporarily or sometimes in the long run.

Who can forget that major cyber incident that targeted a US-based government agency. An organized hacker group successfully infiltrated the government body’s software service provider’s systems. This is one of the massive supply chain attacks that not only shook the nation but also alarmed other parts of the world.

According to our research, cyber-attacks on supply chains have risen by 51% from 2021 on, and 53% of those attacked have admitted that both the company and the supplier are equally responsible for the security breaches.

Why does a supply chain attack happen?

Supply chain cyber-attacks normally happen on a specific target, especially when the “target” has a lot of customers, is popular, and has a global presence. The hackers’ objectives in such attacks are to infiltrate or affect as many suppliers in the entire value chain of the “target.”

Supply chain attacks can happen in any industry. The incentive for the bad actors is that organizations have a lot of contracts with third-party vendors, especially in the manufacturing, pharmaceutical, and government sectors.

Since the weak links are easy to target in the supply value chains, cybercriminals simply consider them “vulnerable points” to get through bigger targets, that is, the allied organizations. The attacks can be on the network, endpoints, and/or servers.

When attacks are successfully executed, the manufacturing process or production is hampered, critical business information is compromised, or, in extreme cases, services are sabotaged, resulting in financial and reputational loss.

Where is the root of the risk?

  1. Typically, organizations do not have a systematic user verification process in place, example, multi-factor authentication (MFA) for every possible path that leads to a critical system. As a result, there is no detection of potential security gaps, and breach attempts can go unnoticed especially from an access management perspective.

  1. Network perimeters are not strong. Many times, firewalls, Intrusion Detection systems (IDS), VPNs are in place, but for incident detection and response, today’s organizations require purpose-built Network Threat Detection and Response mechanism (NDR) to detect malicious network traffic.

  1. While signing off any contract with any third-party service provider, organizations hardly check out their IT security policy or compliance standards. Hence, the organizations remain in the dark about whether this contract (which means mutual sharing of information) could be a potentially vulnerable entry point for a malefactor. Likewise, business contracts often overlook a clause requiring mutual compliance. Organizations are hesitant to scrutinize their audits and compliance reports because they are third-party vendors or small players in the market. As a result, IT risks prevail. It is highly recommended for any organization and vice versa to give adequate importance to the clause of mutual compliance.

  1. Normally, a very few organizations give adequate importance to creating a threat model for its IT environment. Since a threat model includes assigning lists or categories of assets, it can restrict the third-party vendor’s access to the “irrelevant” data assets. As a result, even if there is a cyber incident, the organization remains safe, at least with its few sets of assets. In fact, data assets must be classified differently depending on the vendor in order to improve data management.

  1. In the post-pandemic IT era, a lot is being discussed about automated digital-identity threat detection mechanisms. It secures the vendor with real-time alerts on anything anomalous (if it happens). Without it, neither the organization, nor the vendor would know about the suspicious activity happening inside the IT ecosystem. In-line with these requirements, ARCON leveraging AI and ML technologies, provides a robust stack of solutions that helps to identify threats and respond in real-time while ensuring robust user access governance, especially in a highly critical privileged access environment.

The Bottom-line

Cybercriminals love to strike when you are unprepared. So why take chances? Supply chain attacks are the latest trend in organized cyber incidents. It is important to stay equipped with adequate IT security policies and safeguards to remain unaffected even during supply chain attacks.