Supply Chain Attack

You should be wary of third-party providers

Supply chain attack is a cyber-attack that seeks to damage an organization by targeting less-secure elements in the supply network. A supply chain attack can occur in any industry, from the financial sector, oil industry or government sector. Cybercriminals typically tamper with the manufacturing process of a product by installing a rootkit or hardware-based spying components.

A supply chain attack, also called a value-chain or third-party attack, occurs when someone infiltrates your system through an outside partner or provider with access to your systems and data. This has dramatically changes the attack surface of the typical enterprise in the past few years, with more suppliers and service providers touching sensitive data than ever before.

Although supply chain attack is a broad term without a universally agreed upon definition, in reference to cyber-security, a supply chain attack involves physically tampering with electronics (computers, ATMs, power systems, factory data networks) in order to install undetectable malware for the purpose of bringing harm to a player further down the supply chain network.

In a more general sense a supply chain attack may not necessarily involve electronics. In 2010 when burglars gained access to the pharmaceutical giant Eli Lilly’s supply warehouse, by drilling a hole in the roof and loading $80 million worth of prescription drugs into a truck, they could also have been said to carry out a supply chain attack. However, this article will discuss cyber attacks on physical supply networks that rely on technology; hence, a supply chain attack is a method used by cyber-criminals.

Over View Of Supply Chain attack

The supply chain network is a frequent targets for cyber crimes, as a weak link in the supply chain can grant the cyber criminals access to the larger organization in custody of the data sought after. Supply chain attacks expose a conundrum in a company’s supply network which discloses that an organization’s cyber security controls are only as strong as that of the weakest party on the chain.

Generally, supply chain attacks on information systems begin with an advanced persistent threat that determines a member of the supply network with the weakest cyber security in order to affect the target organization.

APT’s can often gain access to sensitive information by physically tampering with the production of the product. In October 2008, European law-enforcement officials “uncovered a highly sophisticated credit-card fraud ring” that stole customer’s account details by using untraceable devices inserted into credit-card readers made in China to gain access to account information and make repeated bank withdrawals and Internet purchases, amounting to an estimated $100 million in losses.

The drive to minimize operational costs through technological progress brought about the need for a supply network. A company’s supply network usually consists of third party entities like manufacturers, suppliers, handlers, shippers, and purchasers all involved in the process of making products available to the end consumers. Because the target company may have a security system that may be impenetrable for even the sophisticated cyber criminals, supply chain attacks are carried out on the third party businesses on the chain who are deemed to have the weakest internal measures and processes in place. Once one member’s security protocols are found to be weak, the member’s vulnerabilities become the target company’s risk.

Risks Of Supply Chain Attack

The threat of a supply chain attack poses a significant risk to modern day organizations and attacks are not solely limited to the information technology sector; supply chain attacks affect the oil industry, large retailers, the pharmaceutical sector and virtually any industry with a complex supply network.

The risks associated with a supply chain attack have never been higher, due to new types of attacks, growing public awareness of the threats, and increased oversight from regulators. Meanwhile, attackers have more resources and tools at their disposal than ever before, creating a perfect storm.

According to the report, 90% of respondents admitted to incurring a financial cost after experiencing a software supply chain attack. The average cost of an attack like this is just over $1.1 million dollars.

While 90% agree that security is a critical factor when making purchasing decisions surrounding new suppliers, only 37% of respondents in the US, UK and Singapore said that their organisation would be willing to vet all of them.

On top of this, only a quarter of respondents believe with certainty that their organisation will increase its supply chain resilience in the future.

Mismanage of supply chain systems can become significant setback for cyber attacks, which can lead to a loss of sensorial customer information, disruption of the manufacturing process, and could bring the company’s name into bad repute.