Supply Chain Attacks Are On The Rise

Modern companies work with subcontractors and third-party providers in so many ways: from employing third-party experts for solving particular problems to using third-party providers’ teams to monitor corporate security and infrastructure health 24/7. While this partnership proves to be quite beneficial to all parties, there are certain cybersecurity risks to consider.

In particular, more and more hackers are looking for a way to compromise supply chain networks and cause severe damage to large companies and organizations without attacking them directly. These indirect yet devastating attacks are called supply chain attacks.

What’s the danger of supply chain attacks?
So what is a supply chain attack? Basically, it’s a type of attack where hackers don’t target their initial goal directly. Instead, they focus on finding and compromising the most vulnerable elements in their victim’s supply chain network: subcontractors and third-party providers an intended victim works with. There are several ways of compromising a supply chain: from sending phishing emails in order to steal a supplier’s identity to injecting malicious code into a third-party software.

Software supply chain attacks pose the most danger since they are much harder to detect. These attacks target not third-party provider accounts or corporate networks, but third-party software used by a victim. Such an attack can be performed by exploiting existent vulnerabilities in this software or by modifying this software with malicious code insertion.

The main focus of the attackers goes to these three categories of targets:

  • Website builders
  • Third-party software providers
  • Third-party data storages

For instance, hackers may target a software vendor and try to modify one of its products and inject their malicious code into it. As the compromised software spreads among the clients of this provider, so does the malware. As a result, hackers get a chance to cause damage to numerous companies and organizations by compromising just one supplier.

However, cyber supply chain attacks aren’t limited to compromising third-party software solutions. Attackers may also try to hack a supplier’s system and steal their credentials to get access to the main target’s network.

The supply chain silent threat hides in the difficulty of making sure that all of your third parties take their cybersecurity seriously and responsibly enough. Especially, considering the fact that supply chain attacks are currently on the rise.

The rising threat of supply chain attacks

The practice of using suppliers and subcontractors to indirectly hit a larger target becomes more and more common. According to a recent report by Vanson Bourne and CrowdStrike, two-thirds of surveyed companies suffered from a software supply chain attack in the past year. And the average cost of such attacks is estimated to be as high as $1.1 million.

However, what’s even more concerning is that 71 percent of respondents admitted not holding their subcontractors to the same security standards they use. At the same time, the vast majority of the surveyed experts and decision makers — nearly 80 percent — believes software supply chain attacks to be dangerous enough to make it to the top of the biggest cyber threats in the near future. 

Here are some of the most recent software supply chain attacks examples:

CCleaner — Hackers managed to compromise a legitimate application and use it to perform a backdoor attack, infecting over 2 million CCleaner customers worldwide. It’s noteworthy that hackers specifically targeted 18 large companies, including Sony, Intel, Asus, and VMWare. They modified one of the application functions to make it decode and load the malware.
M.E.Doc — Hackers compromised the update server used by the tax-accounting application M.E.Doc. Being used for spreading NotPetya ransomware, the supply chain attack affected operations of banks and companies worldwide, literally paralyzing entire networks. Such companies as FedEx and Maersk report losing around $300 million each as a result of the attack.
PyPi — Hackers targeted the popular programming language — Python — by compromising PyPi servers and replacing original libraries with altered packages that included a check-in beacon.
Kingslayer — Hackers created a backdoor by targeting administrator accounts and replacing the legitimate application with its malware-containing version. As the result of this attack, at least one US defense contractor was compromised. Although, the exact number of infected companies remains unknown.
Transmission — Hackers compromised legitimate servers used for distributing the popular BitTorrent client. They injected a client’s installer with macOS ransomware. 

In each of these cases, attackers picked a trusted, legitimate product or service and exploited it to harm a larger target.

In addition to that, there are numerous examples of large companies suffering from not taking third-party access management seriously enough:

Amazon — In 2017, hackers attacked several third-party vendors working with Amazon and used their credentials for posting fake deals on the platform.
Target — One of Target’s third-party vendors was hacked via phishing. Using the stolen credentials of that vendor, hackers get access to the Target’s billing network.

All these examples lead us to the main question: is it possible to mitigate the risks of supply chain attacks?
How to protect your company against supply chain attacks

The lack of control over third parties is one of the main reasons supply chain attacks are even possible. Therefore, you can significantly improve the level of your company’s cybersecurity by adapting your standard security procedures to include all of your vendors, suppliers, and third-party providers.

Here are some of the best practices for managing supply chain risks:

Vet your subcontractors — Don’t grant third parties access to your network until vetting their current security practices. Request and examine their cybersecurity policy and make sure they follow the same security and compliance standards that you do. When deploying a new product from a third-party software provider, check if the developers used the security development lifecycle process when building this solution.
Set protocols and SLA — Set specific rules for every aspect of cooperating with vendors: from accessing data to sending emails. Keep your cybersecurity standards consistent along the entire supply chain to make it much harder for the attackers to find a weak spot in it.
Deploy access management solutions — Use advanced identity and access management solutions for making sure that only legitimate users have access to your company’s critical assets and sensitive information, and only for those they really need for their work. Also, consider using a one-time password scheme or integrating your access management solution with a ticketing platform.
Monitor your network — Having full visibility of vendor actions within your company’s network is crucial for ensuring a high level of cybersecurity. You can look for a specific third-party vendor monitoring solution or use a universal toolset for monitoring user activity and managing access.
Perform regular audits — Auditing third-party vendors’ activity on a regular basis is just as important as auditing your network. This way you can not only detect suspicious actions, but also see if everyone follows appropriate security practices and whether there are any new weak spots and vulnerabilities in your supply chain.

Conclusion

Understanding the difficulty of attacking large companies directly, hackers take advantage of indirect attacks by targeting their victim’s supply chain. They use various tactics: steal identities, compromise admin accounts, infect legitimate software and applications with malicious code, and so on.

In order to mitigate the risks of supply chain attacks, companies should reconsider their current security policies. Third-party vendors and suppliers are insiders as well and need to be included in the corporate Insider threat Program and follow the same security practices and standards.

Marcell Gogan is a Security Experts at Ekran System

You Might Also Read:

Breakthrough Technologies To Combat Insider Threats:

« Top 8 Most Disturbing Data Breaches In 2018
Indian Government To Provide Handbook On Cyber Safety To School Children »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Organization for Security and Co-operation in Europe (OSCE)

Organization for Security and Co-operation in Europe (OSCE)

OSCE is the world's largest security-oriented intergovernmental organization. Areas of activity include Cyber/ICT security.

CSIRT Malta

CSIRT Malta

CSIRT Malta supports critical infrastructure organisations in Malta on how to protect their information infrastructure assets and systems from cyber threats and incidents.

Bufferzone Security

Bufferzone Security

Bufferzone is a patented containment solution that defends endpoints against advanced malware and zero-day attacks while maximizing user and IT productivity.

Arcanum Information Security (AIS)

Arcanum Information Security (AIS)

Arcanum Information Security is a specialist Information Assurance Consultancy and a leading provider of Cyber Security services to UK Defence, UK Government, Enterprise businesses and SMEs.

National Cyber Security Centre (NCSC) - Switzerland

National Cyber Security Centre (NCSC) - Switzerland

The National Cyber Security Centre is Swizerland's competence centre for cybersecurity and the first contact point for businesses, public administrations, and the public for cyber issues.

Coalition

Coalition

Coalition combines comprehensive insurance and proprietary security tools to help businesses manage and mitigate cyber risk.

H-11 Digital Forensics

H-11 Digital Forensics

H-11 Digital Forensics is a global leader of digital forensic technology.

24By7Security

24By7Security

24By7Security are Cybersecurity & Compliance Specialists with extensive hands on experience helping businesses build a defensive IT Infrastructure against all cyber security threats.

ERI

ERI

ERI is the largest fully integrated IT and electronics asset disposition provider and cybersecurity-focused hardware destruction company in the United States.

Vortiv

Vortiv

Vortiv Ltd (formerly known as Transaction Solutions International Ltd) is a technology based company focused on the cybersecurity and the cloud services sector.

Pentest360

Pentest360

Pentest360 is a 24x7x365 Penetration testing service offered through a feature-rich, centralised platform on the cloud that delivers instant visibility during security assessments.

Securd

Securd

Securd takes opportunities away from your cyber adversaries. Cloud-delivered zero-trust DNS firewall and web filtering protection keep your business network and remote employees safe.

Future Planet Capital

Future Planet Capital

Future Planet is the impact-led, global venture capital firm built to invest in high growth potential companies from the world's top research centres.

Quantropi

Quantropi

Quantropi is bound to be the standard for quantum-secure data communications – forever unbreakable, no matter what.

Mirai Security

Mirai Security

Mirai Security are a cyber security company that specializes in Governance, Risk Management and Compliance, Cloud Security and Application Security.

Cyber Grant

Cyber Grant

Cyber Grant excel in designing cybersecurity solutions for data protection. Our approach and vision, centered on ease-of-use, establish us as a benchmark in the industry for safeguarding information.