Isolating third-party supply chain risks

Third-party suppliers have been identified as the biggest cyber threat to supply chain security, with research revealing that two in every three attacks focus on the supplier. Such attacks on a single supplier can result in exponential harm, compromising an entire network of providers, and leading to downtime in systems, monetary loss, and reputational damage.With the number of supply chain attacks multiplying by a factor of four between 2020 and 2021, it’s clearly a threat that shouldn’t be underestimated. Businesses must therefore take steps to isolate the risks posed by third-parties, to minimise the chances of being damaged by an attack.Dangerous oversight Supply chain security has been overlooked for many years. But, as systems become increasingly integrated and embedded, this oversight can open organisations up to major disruption given the ever-increasing number of attacks.Exploiting a single weakness in a third-party’s software or network can enable attackers to gain access to multiple victims, including businesses, large enterprises as well as critical national infrastructure.The larger the organisation, the higher the stakes, which makes them especially valuable to attackers if a ransom is demanded. Other companies in the supply chain may be smaller, or less focused on security which makes them an easier route for attackers to reach the bigger, more lucrative targets.Due diligenceTackling this threat requires a better understanding of the cause of supply chain attacks and the impact they can have on a business. The truth is, while many organisations may be aware of such incidents, more action must be taken.A company may run through a questionnaire or carry out a cursory check on a third-party supplier, but it’s unlikely that the information gathered from these will make a significant difference in the event of a targeted supply chain attack.Instead, due diligence is required to truly understand which software and hardware the third-party uses, where any potential vulnerabilities might lie, and what steps are being taken to secure their systems from cyber-attack.Understanding and awarenessAs well as understanding the potential security risks represented by their supply chain, organisations should ensure they themselves are protected in the event of an attack. Keeping an asset register and risk register, for example, will help a business understand if it’s been affected by a supply chain breach, and what the impact of that breach was. This, in turn, will help the business create mitigations and playbooks for responding to an attack on that supply chain.Organisations also need a complete and comprehensive overview of any third-party software they use and ensure its security configurations are up to the same level as their own internal systems. Identity Access Management, for instance, should stretch beyond just their own networks to cover their entire SaaS ecosystem to give them confidence that any data stored in those applications is safe and secure.Businesses should also regularly evaluate the type of data stored in those applications, and carry out a risk assessment to help mitigate the chances of it being compromised. Using third-party vendors is a necessity but ensuring they meet the required compliance standards is even more important.Third-party suppliers are an attractive, and often easy, point of entry to an organisation’s network and systems. It’s vital, therefore, that businesses remain aware of where those third-parties might be vulnerable, and make sure their own network is isolated from the impact of any attack on their supply chain.

Isolating third-party supply chain risks

Isolating third-party supply chain risks

Related content

Palo Alto Networks Dismiss Number of Vulnerable Firewalls

Apple Patches Zero-Day Vulnerabilities

Palo Alto Issues Warning on Interface Flaw

A Million NHS Employees Potentially Impacted in Breach

Data Aggregator Sees data of 122 Million Businesses Exposed

Russian Attackers Used Microsoft Flaw to Exploit Ukranians

Most Exploited Vulnerabilities Began as Zero-Days

Upcoming Events

Isolating third-party supply chain risks

Isolating third-party supply chain risks

Related content

Palo Alto Networks Dismiss Number of Vulnerable Firewalls

Apple Patches Zero-Day Vulnerabilities

Palo Alto Issues Warning on Interface Flaw

A Million NHS Employees Potentially Impacted in Breach

Data Aggregator Sees data of 122 Million Businesses Exposed

Russian Attackers Used Microsoft Flaw to Exploit Ukranians

Most Exploited Vulnerabilities Began as Zero-Days

Upcoming Events

Confirm cancellation

Sign up benefits