Digital supply chains: the latest target for cyber attacks

Glob­al sup­ply chains have been exposed to unprece­dent­ed risk in recent years. A host of issues, rang­ing from Brex­it and the Suez Canal block­age to the Covid-19 cri­sis and, most recent­ly, the war in Ukraine, have all caused huge dis­rup­tion.

But sup­ply chain risk is not lim­it­ed to the phys­i­cal sphere. As busi­ness­es have grown expo­nen­tial­ly thanks to increased dig­i­tal­i­sa­tion and reliance on third-par­ty dig­i­tal prod­ucts, they have left them­selves exposed to a grow­ing cyber threat.  

Sup­ply chain attacks are when a company’s data is com­pro­mised via the hack­ing of a third-par­ty sup­pli­er with legit­i­mate access to its cus­tomers’ sys­tems. Hack­ers can insert mali­cious code into trust­ed hard­ware or soft­ware at the source, com­pro­mis­ing the data of its cus­tomers – and their cus­tomers – in an onward chain.

One of the most dev­as­tat­ing exam­ples of a sup­ply chain attack was the 2020 Solar­Winds inci­dent, referred to by Microsoft pres­i­dent Brad Smith as the “largest and most sophis­ti­cat­ed attack ever”.

In late 2019 the major US IT firm was tar­get­ed by hack­ers – lat­er iden­ti­fied as orig­i­nat­ing in Rus­sia – who used mali­cious code to gain access to the sen­si­tive data of many of Solar­Winds’ clients, includ­ing tech­nol­o­gy giants Microsoft and Cis­co, and the US Depart­ment of Home­land Secu­ri­ty. In March 2020, Solar­Winds began unwit­ting­ly sent out soft­ware updates to its cus­tomers that includ­ed the hacked code, which enabled the hack­ers to access their IT sys­tems and data too. 

The breach went unde­tect­ed for months, with some vic­tims not know­ing whether they had been hacked at all. The full extent of the attack is yet to be deter­mined, mean­ing it could take years to ful­ly secure all of the sys­tems affect­ed.

Third-party dependency

As com­pa­nies have accel­er­at­ed their dig­i­tal­i­sa­tion strate­gies to con­tin­ue oper­at­ing and sup­port their staff remote­ly dur­ing the pan­dem­ic, so they have become more depen­dent on third-par­ty soft­ware and tech­nol­o­gy. This, in turn, has increased firms’ attack sur­face expo­sure and points of vul­ner­a­bil­i­ty.

Sup­ply chain attacks often start due to a mis­man­age­ment of crit­i­cal access points. Known weak­ness­es in IT man­age­ment plat­forms are then exploit­ed, as evi­denced by Log4Shell, a crit­i­cal vul­ner­a­bil­i­ty in the log­ging tool Log4j, which is used by mil­lions of com­put­ers world­wide.

Hack­ers tar­get vic­tims through the key com­mu­ni­ca­tion chan­nels and soft­ware of third-par­ty sup­pli­ers to gain access to their cus­tomers. A favoured attack method is through hijacked soft­ware updates – as in the Solar­Winds case – account­ing for 60% of soft­ware sup­ply chain attacks and dis­clo­sures, accord­ing to US think tank The Atlantic Coun­cil.

“Over the past few years, there has been an increase in next-gen­er­a­tion sup­ply chain attacks,” says Ilk­ka Turunen, field chief tech­nol­o­gy offi­cer at sup­ply chain secu­ri­ty firm Sonatype. “These types of direct attacks involve, for exam­ple, mali­cious actors inject­ing new vul­ner­a­bil­i­ties first-hand into open source projects.” 

To com­bat the threat from sup­ply chain attacks, com­pa­nies should have full vis­i­bil­i­ty of all their third-par­ty rela­tion­ships and depen­den­cies. That means reduc­ing the num­ber of third-par­ty providers they use, wher­ev­er pos­si­ble, so there are few­er enti­ties they have to mon­i­tor.

Vetting process

Of course, this does not guar­an­tee the integri­ty of their prod­ucts. 

“Regard­less of the vendor’s rep­u­ta­tion, the prod­uct itself might have secu­ri­ty gaps,” says Hein­rich Smit, deputy chief infor­ma­tion secu­ri­ty offi­cer at cyber­se­cu­ri­ty spe­cial­ists Sem­peris. 

“When work­ing with new­er com­pa­nies, be sure that you can view the company’s prod­uct con­trols. Inde­pen­dent code reviews and appli­ca­tion vul­ner­a­bil­i­ty reports are very help­ful as well, because they eval­u­ate a prod­uct both inside the code as well as in situ from a pen­e­tra­bil­i­ty per­spec­tive.”

When assess­ing third-par­ty sup­pli­ers, com­pa­nies must ensure that they are thor­ough­ly vet­ted and that their secu­ri­ty prac­tices meet the required stan­dards. They also need to put in place a con­tract with the appro­pri­ate claus­es to ensure they com­ply with the nec­es­sary reg­u­la­to­ry and leg­isla­tive pri­va­cy and secu­ri­ty require­ments.

Firms also need to analyse emerg­ing third-par­ty risks, as well as mon­i­tor­ing for sus­pi­cious activ­i­ties on their sys­tems and net­work. They should also only give net­work and sys­tems access to those third-par­ty ven­dors and appli­ca­tions that require it to per­form their duties, and iden­ti­fy and mon­i­tor all access points. 

Patch­ing should be car­ried out on an ongo­ing basis, by rank­ing and sched­ul­ing updates in order of impor­tance. In addi­tion, organ­i­sa­tions should reg­u­lar­ly back­up their sys­tems to main­tain their data. This is in addi­tion to hav­ing all nec­es­sary cyber­se­cu­ri­ty pro­to­cols in place and com­ply­ing with the rel­e­vant data pro­tec­tion laws and reg­u­la­tions, as well as imple­ment­ing ongo­ing staff train­ing and knowl­edge updates.

Should the worst hap­pen and a breach occur, com­pa­nies must have a robust inci­dent response and risk man­age­ment strat­e­gy in place, as well as a dis­as­ter recov­ery and busi­ness inter­rup­tion plan to ensure they get back on their feet with min­i­mal dis­rup­tion to ser­vices. 

Organ­i­sa­tions also need to learn from pre­vi­ous cyber attacks and shore up their vul­ner­a­ble areas by car­ry­ing out inter­nal pen­e­tra­tion tests. 

One such com­pa­ny that has con­sid­ered these issues at length is E.ON. The Euro­pean util­i­ty provider, which serves 53 mil­lion cus­tomers across 30 coun­tries, recog­nised the need to expand its process­es and pro­ce­dures to pro­tect itself and its cus­tomers from poten­tial data loss via its third-par­ty online ecosys­tem.

“To tack­le the issue, E.ON first had to under­stand the risks it was exposed to,” says Ran Nah­mias, co-founder and chief busi­ness offi­cer at Cyber­pi­on, whose ecosys­tem secu­ri­ty plat­form E.ON used to gain full vis­i­bil­i­ty of its vul­ner­a­bil­i­ty to cyber attacks. 

By dis­cov­er­ing and car­ry­ing out an inven­to­ry of E.ON’s inter­net-fac­ing assets and the third-par­ty assets it relies on, as well as the chains of ven­dor rela­tion­ships, the com­pa­ny was able to under­stand its total risk expo­sure and allo­cate resources accord­ing­ly, reduc­ing its expo­sure to oper­a­tional dis­rup­tions and data loss.  

While the com­plex threat from sup­ply chain attacks remains, busi­ness­es that focus on analysing their expo­sure pro­file and mit­i­gat­ing the risks they dis­cov­er give them­selves the best chance of out­wit­ting the hack­ers.