Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

6 Steps to Ensure a More Secure Supply Chain Environment

Threat groups intending to cause widespread damage often opt to use a supply chain attack, as seen in the massive supply chain compromise that struck VOIP software provider 3CX on March 29. Trustwave SpiderLabs has issued a blog detailing the attack and upcoming steps to mitigate the problem.

Striking an organization's supply chain simplifies the attack process by eliminating the need to strike multiple targets by instead focusing on breaching one organization that is key to many others. In the case of 3CX, the attacker could potentially impact 600,000 companies globally and more than 12 million users daily.

These attacks can also take the form of striking critical infrastructure, turning off the fuel delivery capabilities for a region, or injecting malware in a software vendor's product that is spread through periodic updates, as was the case with 3CX. These attacks can be for financial gain, hacktivist activity, or to damage a nation-state enemy.

1. Containing the Risk

The risk imposed by supply chain attacks cannot be eliminated, but over the years, a great deal of discussion has taken place in security circles on the best way to manage supply chain cyber risk.

Recommendations such as using trusted networks, information sharing, scenario planning, and quantification metrics have been broadly accepted by organizations.

These actions may be helpful but don't fully solve the problem unless deployed by all stakeholders, meaning everyone in the supply chain – and that's a tall order. Improved risk management must start from within, remembering what's in your control first. Keep these things in mind:

2. Relationship Building

Build a strong relationship between an organization's procurement department and security.

Knowing that supplier lists are often incomplete and outdated, get a proactive grasp on changing vendor dynamics by building a relationship with your procurement team for cyber risk integration. Because procurement is often only involved with certain levels of vendor acquisition, you'll better identify gaps if they understand the risks associated with reduced visibility into supplier changes.

3. Triage and Assess Your Supplier List

Once you can more clearly see the full supplier ecosystem, rank your list by importance and create a process for evaluating the effectiveness of each supplier's security. Specialized support for an undertaking like this may help make this important component of your risk management strategy feel more feasible.

Your assessment framework should cover a variety of cybersecurity standards and best practices, e.g., from the National Institute of Standards and Technology (NIST) or CIS Critical Security Controls (formerly SANS). Questions range from the supplier's ability to encrypt data, whether it uses MFA, the supplier's password policies, patching program management, architecture and segmentation, cloud usage, and many more. 


4. Assessing the Assessment

A best practice is to balance your assessment questions. Too few and you won't know what's actually going on, too many and you'll be lucky to get a response from your suppliers.

Trustwave Security Colony’s Vendor Assessment addresses multiple primary domains addressed in its assessment tool, which is the right amount. More importantly, assessment questionnaires are just the start. Ask for evidence, such as their security policy, penetration test reports, and certifications like ISO 27001 and SOC2 reports. Note: A supplier can fake these reports, so make sure they are legit.

The assessment is only as good as the tool or the human analysis behind it. We recommend you know which parameters impact a vendor's risk rating and how that vulnerability may impact your business.

For example, will SSL vulnerabilities in that vendor pose a risk to your business? If they're storing your client data on a public-facing system, this will be a problem, and a high-risk one at that, but if they're providing flowers at your front desk, it likely will not be an issue.

5. Include Suppliers in Your Security Awareness Programs

This doesn't mean you are involved in their incident response. Instead, it offers the option to plug them into your incident response plan if something takes place. Consider involving key suppliers in scenario planning, as well, to build strategy and protocols around the reality that what they do affects your security – and vice versa.

6. Focus on Detection

While there are many things outside of your control, such as devices that are compromised at the source, and suppliers who are compromised and affect you – there is still much you can do to identify threats sooner to mitigate risk and reduce the damage done.

Understanding the complexity – and likelihood – of supply chain attacks and the sheer number of possible vulnerabilities across systems shifts the focus onto detection for the broadest ongoing risk management. When detection becomes a priority woven into ongoing security programs, your efforts will result in the foundation for a truly resilient organization – supply chain and overall.

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More