Threat groups intending to cause widespread damage often opt to use a supply chain attack, as seen in the massive supply chain compromise that struck VOIP software provider 3CX on March 29. Trustwave SpiderLabs has issued a blog detailing the attack and upcoming steps to mitigate the problem.
Striking an organization's supply chain simplifies the attack process by eliminating the need to strike multiple targets by instead focusing on breaching one organization that is key to many others. In the case of 3CX, the attacker could potentially impact 600,000 companies globally and more than 12 million users daily.
These attacks can also take the form of striking critical infrastructure, turning off the fuel delivery capabilities for a region, or injecting malware in a software vendor's product that is spread through periodic updates, as was the case with 3CX. These attacks can be for financial gain, hacktivist activity, or to damage a nation-state enemy.
1. Containing the Risk
The risk imposed by supply chain attacks cannot be eliminated, but over the years, a great deal of discussion has taken place in security circles on the best way to manage supply chain cyber risk.
Recommendations such as using trusted networks, information sharing, scenario planning, and quantification metrics have been broadly accepted by organizations.
These actions may be helpful but don't fully solve the problem unless deployed by all stakeholders, meaning everyone in the supply chain – and that's a tall order. Improved risk management must start from within, remembering what's in your control first. Keep these things in mind:
2. Relationship Building
Build a strong relationship between an organization's procurement department and security.
Knowing that supplier lists are often incomplete and outdated, get a proactive grasp on changing vendor dynamics by building a relationship with your procurement team for cyber risk integration. Because procurement is often only involved with certain levels of vendor acquisition, you'll better identify gaps if they understand the risks associated with reduced visibility into supplier changes.
3. Triage and Assess Your Supplier List
Once you can more clearly see the full supplier ecosystem, rank your list by importance and create a process for evaluating the effectiveness of each supplier's security. Specialized support for an undertaking like this may help make this important component of your risk management strategy feel more feasible.
Your assessment framework should cover a variety of cybersecurity standards and best practices, e.g., from the National Institute of Standards and Technology (NIST) or CIS Critical Security Controls (formerly SANS). Questions range from the supplier's ability to encrypt data, whether it uses MFA, the supplier's password policies, patching program management, architecture and segmentation, cloud usage, and many more.
4. Assessing the Assessment
A best practice is to balance your assessment questions. Too few and you won't know what's actually going on, too many and you'll be lucky to get a response from your suppliers.
Trustwave Security Colony’s Vendor Assessment addresses multiple primary domains addressed in its assessment tool, which is the right amount. More importantly, assessment questionnaires are just the start. Ask for evidence, such as their security policy, penetration test reports, and certifications like ISO 27001 and SOC2 reports. Note: A supplier can fake these reports, so make sure they are legit.
The assessment is only as good as the tool or the human analysis behind it. We recommend you know which parameters impact a vendor's risk rating and how that vulnerability may impact your business.
For example, will SSL vulnerabilities in that vendor pose a risk to your business? If they're storing your client data on a public-facing system, this will be a problem, and a high-risk one at that, but if they're providing flowers at your front desk, it likely will not be an issue.
5. Include Suppliers in Your Security Awareness Programs
This doesn't mean you are involved in their incident response. Instead, it offers the option to plug them into your incident response plan if something takes place. Consider involving key suppliers in scenario planning, as well, to build strategy and protocols around the reality that what they do affects your security – and vice versa.
6. Focus on Detection
While there are many things outside of your control, such as devices that are compromised at the source, and suppliers who are compromised and affect you – there is still much you can do to identify threats sooner to mitigate risk and reduce the damage done.
Understanding the complexity – and likelihood – of supply chain attacks and the sheer number of possible vulnerabilities across systems shifts the focus onto detection for the broadest ongoing risk management. When detection becomes a priority woven into ongoing security programs, your efforts will result in the foundation for a truly resilient organization – supply chain and overall.
