Cyberattacks and the threat to global supply chains

June 2017 was a bad month for the world’s biggest con­tain­er ship­ping line. Maer­sk sud­den­ly found its com­put­er sys­tems grind­ing to a halt in the face of a cyber­at­tack caused by the Not­Petya mal­ware.

In fact, Maer­sk, which car­ries almost one fifth of the con­tain­ers moved glob­al­ly, was one of sev­er­al major inter­na­tion­al busi­ness­es that fell vic­tim to the mal­ware. Anoth­er notable vic­tim was express parcels giant TNT. The cost to these com­pa­nies was huge, not to men­tion the dis­rup­tion to their cus­tomers’ sup­ply chains. Maer­sk reck­ons it lost almost $300m in rev­enue and IT restora­tion costs, while TNT cal­cu­lat­ed the cost at $400m.

Some­times cyber­at­tack­ers demand a ran­som. Ear­li­er this year, the Colo­nial Pipeline in the Unit­ed States faced a $4.4m demand after its net­work was hacked and its oper­a­tions halt­ed.

While these attacks dis­rupt­ed oper­a­tions, often attack­ers are try­ing to steal data. US retail­er Tar­get had to pay out $18.5m in claims after a 2013 cyber­at­tack in which the attack­ers were able to steal cred­it card data for some 40 mil­lion cus­tomers.

In fact, cyber­at­tacks are more com­mon than peo­ple realise, says Richard Wild­ing, pro­fes­sor of sup­ply chain strat­e­gy at Cran­field Uni­ver­si­ty. Vic­tims don’t open­ly dis­cuss attacks for fear that it will open them up to fur­ther attacks. Mar­cus Wuerk­er, chief infor­ma­tion offi­cer at DHL Sup­ply Chain, agrees: “Phish­ing is pret­ty much com­mon­place these days; we’re also see­ing occa­sion­al busi­ness email com­pro­mise attempts, as well as the more tra­di­tion­al denial of ser­vice attacks.”

There is also evi­dence that cyber­at­tack­ers are shift­ing the focus of their activ­i­ties towards sup­ply chains.

Europe’s cyber­se­cu­ri­ty agency Enisa has warned that it expects four times as many attacks on sup­ply chains this year than in 2020. It argues that the cost of attack­ing well pro­tect­ed organ­i­sa­tions is increas­ing. And as a result, attack­ers are switch­ing their atten­tion to their sup­ply chains. And it reck­ons that, giv­en the inter­na­tion­al nature of sup­ply chains, the poten­tial impact is also increas­ing.

In July, Enisa pub­lished an analy­sis of the poten­tial threats to sup­ply chains which found that 62% of the attacks on cus­tomers took advan­tage of their trust in their sup­pli­er.

Deal­ing with the threat means, in the first instance, focus­ing on the basics, says Wild­ing. In par­tic­u­lar, he points to the Cyber Essen­tials scheme backed by the UK government’s Nation­al Cyber Secu­ri­ty Cen­tre, which he says, should be part of any sup­pli­er assess­ment exer­cise. This offers two lev­els of cer­ti­fi­ca­tion. The basic lev­el – Cyber Essen­tials – offers pro­tec­tion against most com­mon cyber­at­tacks. Cyber Essen­tials Plus goes one step fur­ther to pro­vide a hands-on tech­ni­cal ver­i­fi­ca­tion. 

The Char­tered Insti­tute of Pro­cure­ment and Sup­ply makes the case for more aware­ness and col­lab­o­ra­tion. Group direc­tor Dun­can Brock says com­pa­nies that have been vic­tims of cyber­at­tacks need to move away from not being will­ing to share any details because they are too embar­rassed: “I can under­stand why organ­i­sa­tions do this but it’s a big­ger prob­lem for busi­ness­es and glob­al soci­ety, and a grow­ing one that indi­vid­u­als or busi­ness­es can’t solve on their own.

“Also, as reg­u­la­tion around this deep­ens, busi­ness­es will be look­ing for more exper­tise and more dig­i­tal­i­sa­tion and trans­paren­cy in their sup­ply chains, so they don’t fall foul of leg­is­la­tion as well as suf­fer an attack or affect oth­ers,” he adds.

Not sur­pris­ing­ly, soft­ware providers have been work­ing hard to pro­vide sys­tems to neu­tralise cyber­se­cu­ri­ty threats. For exam­ple, SAP, which sup­plies IT sys­tems to some of the world’s biggest com­pa­nies, offers a secu­ri­ty infor­ma­tion and event man­age­ment tool that iden­ti­fies secu­ri­ty gaps and detects threats both inter­nal and exter­nal.

Arti­fi­cial intel­li­gence is increas­ing­ly being employed to tack­le cyber threats. Dark­trace, found­ed in Cam­bridge in 2013, used AI to learn the dig­i­tal DNA of organ­i­sa­tions enabling them to build up resilience to cyber­at­tacks. In July, it revealed that it was inter­cept­ing 4,000 cyberthreats each week at lifestyle brand Ted Bak­er.

Sup­ply chain links are often the most vul­ner­a­ble point and sup­ply chain part­ners have a key role to play in ensur­ing that they are ade­quate­ly pro­tect­ed. Wuerk­er says: “Work­ing with a multi­na­tion­al logis­tics provider may allow cus­tomers to lever­age their provider’s more resilient and secure IT infra­struc­ture, with built-in glob­al redun­dan­cies, cyber­at­tack detec­tion and pre­ven­tion capa­bil­i­ties.”

Pro­tec­tion against future attacks is essen­tial, because one thing that is clear is that cyber­at­tacks will con­tin­ue to threat­en glob­al sup­ply chains.