Ways to prevent Supply Chain Attacks to happen

In late 2020, an incredible story broke: US government agencies, including Commerce, Treasury, and Homeland Security, had been severely compromised through a malicious backdoor surreptitiously implanted into network management software supplied by a trusted vendor, SolarWinds. Weeks later, tens of thousands of organizations were scrambling to deploy a set of emergencies “zero-day” patches for Microsoft Exchange Server in an attempt to prevent another series of catastrophic compromises. As incredible as those events have been, supply chain attacks are neither new nor surprising.

Despite the subtlety involved in this attack, it is still possible to prevent a supply chain attack. Under the guidance, principles of supply chain security are divided into several stages.

To fight supply chain attacks, companies can integrate a number of techniques, ranging from addressing issues with their general cybersecurity infrastructure to ensuring endpoints are secured against infiltration.

People are the primary target for cybercrimes because they are usually tricked into permitting cybercriminals access into an ecosystem.

The most common form of trickery is scam emails (or phishing attacks). These emails seem like they’re sent from trustworthy colleagues but upon interacting with them, the malicious code planted on the email will be executed that could lead to internal system access. This access is then further abused by the attacker to hunt for higher privileged accounts.

To prevent such incidents, all staff (yours and vendor’s that has access to your system) need to be educated about common cyberattack methods so that they can identify and report breach attempts, rather than falling victim to them.

Data leaks are unintentional disclosures of sensitive data. If these leaks remain unremediated, they could be exploited by cybercriminals and used to launch supply chain attacks.

Many vendors are unaware of their own data leaks and leave them exposed. By implemented a third-party data leak detection solution, vendor data leaks can be detected and remediated before they have a chance to develop into supply chain attacks.

A Zero Trust Architecture assumes all network activity is malicious by default. Only after each connection request passes a strict list of policies is it permitted to access intellectual property.

At a high level, a ZTA is powered by a Policy Engine (PE), a Policy Administrator (PA), and a Policy Enforcement Point (PEP).

The Policy Engine decides whether network traffic should be permitted by following the rules set by the Trust Algorithm. The Policy Administrator communicates the Policy Engine’s decision (pass or fail) to the Policy Enforcement Point.

The Policy Enforcement Point is the final gatekeeper that either blocks or permits network requests based on the Policy Engine’s decision.

Shadow IT refers to all IT devices that are not approved by an organization’s security team. The recent global adoption of a remote-working model has resulted in many employees incorporating their own private IT devices while establishing their home office environments.

IT security departments should enforce the registration of all IT devices alongside strict guidelines about what can and cannot be connected. All permitted devices (especially IoT devices) should be monitored to identity DDoS attacks being launched from the supply chain.

Many supply chain attacks focus on compromising developer workstations or development environments. A developer workstation, which has permission to commit code to the CI/CD pipeline, is a “jackpot” for attackers. This is how the infamous SolarWinds attack breached the company’s build pipeline and was able to deploy malicious artifacts directly into its product.

You should comprehensively protect any endpoint – workstation, server, or cloud virtual machine – that is part of your organization’s build process. This can be done by deploying endpoint protection platforms, including endpoint detection and response (EDR) technology, which can detect anomalous behavior on endpoints and facilitate immediate response by security teams.

With an IAM, multiple access privileged accounts can be managed from a single interface. This will ensure all privileged accesses are accounted for, preventing exposure risks from dormant accounts.

Data at rest and data in transit should be encrypted even though its internal data as the internal network are as vulnerable as the external network and the threats can comes both from internal and external. Encrypting internal data also provide additional layer of defense and supporting the ZTA policy.

The day disaster strikes is not the time to find out if your disaster recovery plan is well designed. Instead, simulate a worst-case scenario ahead of time and see if any gaps emerge.

Ongoing validation of your processes and controls is a must. Without it, you won’t know your blind spots and where improvements are needed. Get in touch to discuss your security concerns – we do not endorse any products. You will receive a true third party opinion based on your environment, sector-specific context and guidelines.