Cyber attacks can happen to any size organization, from a small business with a handful of employees to a large multi-national corporation. No matter what size the company, these attacks can have costly and long-term impacts on the victim.
However, when one specific type of organization is attacked, it can have more far-reaching consequences that go beyond that one business. This is the case with organizations in the supply chain.
Supply chain companies can supply food, petroleum products, transportation capabilities, software and technology systems, or other products/services. When supply chain attacks hit, you can have shortages that drive up the price of products (which was the case when Colonial Pipeline was hit with ransomware in 2021).
Software companies are also important supply chain entities. If the product they sell is infected with malware, that can lead to widespread breaches. This happened in the case of the Kaseya breach just a few months back.
Kaseya is a developer of software that enables remote IT management activities. This software is sold to managed services providers and then installed on both their systems and the systems belonging to the MSPs’ customers.
Ransomware was injected into Kaseya’s software, which then trickled down to impact the entire customer base – both the MSP systems and their customers. It’s estimated that as many as 1,500 small and mid-sized companies (“collateral damage”) were impacted by the breach of this supply chain company.
So, companies that are innocent bystanders can suffer when a supplier is breached.
Table of Contents
Supply Chain Attacks Are Growing
Why should you worry about supply chain attacks? The main reason is that they are growing in volume. This happens as hackers have discovered conducting one-to-many attacks like these can optimize their ill-gotten gains from ransomware or another type of attack.
Here are some alarming statistics about the rise of supply chain attacks:
- In just the first three months of 2021, supply chain attacks grew by 42%.
- 97% of companies have been impacted by a breach in their supply chain.
- 93% of companies suffered a direct breach because of a supply chain security vulnerability.
What can you do to protect your business from being breached or having your own production problems due to a cyberattack in your supply chain?
Ways to Reduce Your Risk of Losses from a Supply Chain Attack
While it may seem out of your control if another company you do business with is successfully breached in a cyberattack, there are important steps you can take to reduce your risk.
Review the Security Policies of Your Vendors
You can’t just assume the technology companies that you do business with and entrust with your data are taking appropriate cybersecurity precautions. Ask to see security policies and details about how your data is stored.
If software is installed on your system that was developed by a vendor, then request details on how often they conduct security audits and issue security-related updates.
If you need help combing through security policies to identify what is “good” or “lacking,” our Cloudavize experts will be happy to help.
Use Zero-Trust With Behavior Monitoring
If software you use has malware that tries to access a system it shouldn’t you can catch this if you have the right monitoring tools in place.
Using a zero-trust approach simply means employing tactics that continually challenge the legitimacy of a user or process in your system. One important tenant of zero-trust is continuous system monitoring for any strange behaviors.
This can alert you to an issue with a vendor’s software before the vendor may even realize it.
Have a Business Continuity Plan in Place
Even small businesses need a business continuity plan. This is a document that outlines the risk to your business operations (cyberattacks, data loss, loss of raw material supply, etc.) and the steps your company will take to both mitigate disruption and bounce back from a crisis event.
For example, if a company your product sells is reliant on one particular raw material, you may put a second supplier in place for that material so you’re not completely dependent on one.
In the case of mitigating digital supply chain attacks, you may have a ransomware response plan in place and do regular penetration testing of your network to ensure your own security is strong.
Document & Manage Supply Chain Risk
As part of a business continuity plan, you should document all your suppliers and then assign a risk level. The risk level can be low, for example, if you see that the supplier has stringent cyber security protections in place to prevent breaches.
If the supplier is not using strong security, perhaps they do not have multi-factor authentication in use, this would indicate a supplier with a higher risk factor.
Having this all down in a document helps you better manage your supply chain risk because it’s known to you, rather than you being in the dark about it.
Schedule a Supply Chain Security Audit
Cloudadvize can help your Dallas-Fort Worth business get started with documenting and evaluating your digital supply chain risk
Contact us today for a free consultation to get started.
