How to ensure your vendors are cybersecure to protect you from supply chain attacks

2 years ago 225

Right present supply-chain vendors are a premier people for cybercriminals. One adept offers ways to region the bullseye from proviso vendors.

cybersecurity conept

Image: Jaiz Anuar/Shutterstock

There aren't galore definite things successful life, and, sadly, 1 of them is however criminals—cyber oregon otherwise—always leverage the victim's weakest nexus to guarantee their success. TechRepublic's Tom Merritt, successful his article, video and podcast, Top 5 things to cognize astir proviso concatenation attacks, looked astatine 1 important anemic nexus making headlines, proviso chains. 

SEE: How to negociate passwords: Best practices and information tips (free PDF) (TechRepublic)

Merritt said, "Even though you're not successful complaint of the vulnerability successful this case, you person options. Make definite your vendors (suppliers) conscionable pugnacious information standards and hold to third-party testing."

Kevin Reed, CISO astatine Acronis, could not hold more. In his Help Net Security article, How tin a concern guarantee the information of their proviso chain?, Reed specifically focused connected Merrit's interest astir making definite supply-chain vendors are putting distant the effort to conscionable information standards. 

Reed offered the pursuing advice: Assess the imaginable fallout from a compromised supplier. Before a determination to usage a supplier is made, Reed suggests a afloat hazard appraisal if resources are available. The minimum should, astatine least, see gathering a worst-case script by asking the pursuing questions:

  • How would the concern beryllium affected if the supplier's programs were compromised?
  • How would the concern beryllium impacted if the supplier's databases were compromised, with information being stolen oregon frozen by ransomware?
  • How would the concern beryllium impacted if cyberattackers gained entree to the business' interior network?

Meet the supplier's information manager oregon CISO: Obtaining interaction accusation astir important cybersecurity unit (managers and CISOs) is obvious. "It is important to place the supplier's information enactment due to the fact that that is who tin reply your questions," Reed said. "If a cybersecurity squad is non-existent oregon poorly staffed with nary existent leadership, you whitethorn privation to reconsider engaging with this supplier."

Evaluate the supplier's IT resources: The radical liable for cybersecurity should beryllium consenting to explicate however the company's integer systems and information are protected. "Request grounds to verify what the supplier is claiming," Reed said. "Penetration trial reports are a utile mode to bash this. Be definite the scope of the trial is due and, whenever possible, petition a study connected 2 consecutive tests to verify that the supplier is acting connected its findings."

"If the supplier is simply a bundle provider, inquire for an autarkic root codification review," He said. "In immoderate cases, the supplier whitethorn necessitate a non-disclosure statement to stock the afloat study oregon whitethorn take not to stock it. When this happens, inquire for an enforcement summary."

SEE: Cybersecurity: Don't blasted employees—make them consciousness similar portion of the solution (TechRepublic) 

"If the supplier is simply a unreality provider, you tin execute a Shodan search oregon inquire the supplier for a study of their scans," Reed said. It is imaginable to execute the scan autarkic of the supplier. If that is an option, Reed suggested obtaining a licence from the supplier and asking them to isolate lawsuit addresses arsenic they are not relevant.

Ask suppliers however they prioritize risk: If the institution performs hazard assessments, its suppliers should arsenic well. A communal mode to bash this is utilizing the Common Vulnerability Scoring System: "A escaped and unfastened manufacture modular for assessing the severity of machine strategy information vulnerabilities by assigning severity scores to vulnerabilities, which successful crook allows responders to prioritize responses and resources according to the threat."

Something other to consider, Reed suggested looking astatine the supplier's logs connected updating and patching systems. "The information they person a study demonstrates their committedness to information and managing vulnerabilities," Reed said. "If possible, effort to get a study that is produced by an autarkic entity."

SEE: Working astatine a harmless distance, safely: Remote enactment astatine concern sites brings other cyber risk (TechRepublic)

Repeat the verification process annually: Consistent verification is indispensable if the supplier provides mission-critical materials oregon services for the institution being supplied.

What's to beryllium gained?

By pursuing the above-recommended practices, Reed believes companies volition summation the following: 

  • The quality to place the risks associated with a peculiar supplier 
  • An knowing of however the supplier manages those risks
  • Evidence regarding however the supplier is mitigating those risks

"Based connected this grounds and the hazard appetite, a concern tin marque an informed determination to enactment with this supplier," Reed said. "Lastly, arsenic you execute these assessments, purpose for consistency and look for hazard that changes implicit time."

More things to know 

Reed is good alert determination are nary guarantees, particularly erstwhile dealing with proviso chains. Besides pursuing the supra practices, Reed emphasizes the necessity to support the company's integer situation with capable anti-malware and to behaviour ongoing cybersecurity grooming with institution employees. 

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays

Sign up today

Also see

Read Entire Article