Supply chain vulnerabilities can run both ways. An attack on one link in the chain can have an impact on all businesses within it. Criminals will also target smaller businesses within the chain to gain access to larger organisations.

Taking action on supply chain risk is a significant part of the government’s Cyber Resilience Pledge, which asks organisations to commit to requiring Cyber Essentials certification across their supply chains. 

“Businesses depend on suppliers’ systems to process orders, move goods and make payments, so a cyber incident elsewhere in the chain can quickly become their own operational and financial problem,” says Ben Farrell, Global CEO at the Chartered Institute of Procurement & Supply.

Scammers have also been impersonating customers on emails to change the delivery destination of trucks or containers, diverting legitimate shipments to their own premises, James Hookham, Director at the Global Shippers Forum, says. “This is currently big in the US.”  

Jennifer Williams, Managing Director at Secarma, recalls a large software provider’s supply chain that was infiltrated by criminals who embedded malicious code into a routine software update. Rather than targeting victims one by one, the attackers inserted themselves into a trusted distribution channel and used the company’s reach to spread the compromise far and wide.

“Thousands of organisations downloaded the update believing it was legitimate, creating a potential pathway into some of the world's largest organisations,” says Williams.

Another example involved attackers stealing the credentials of a third-party contractor with authorised access to a customer's network, Williams continues. Instead of exploiting software, they exploited a trusted business relationship. Once inside, they were able to move through the network and access sensitive information.

"In both cases, the attackers bypassed traditional defences by targeting a trusted link in the supply chain rather than the intended victim directly.”

How do these weaknesses occur?

Weaknesses develop when organisations lack visibility of who can access their systems, what information suppliers hold and what other businesses those suppliers depend on, explains Farrell. “A direct supplier may use subcontractors or external technology providers whose security arrangements have never been examined by the customer.”

Farrell adds that unclear responsibilities compound the problem. “If a contract does not establish who maintains software, manages access or responds to an incident, important tasks can fall between organisations.” 

Software that has not been updated and weak passwords leave businesses vulnerable, but Hookham says phishing attacks are still a common cause. 

“Another route is by impersonating a legitimate party’s emails and getting workers to part with passwords and other sensitive information,” says Hookham. “Also, disgruntled employees who know and deliberately work around security protections or abuse authorisations, as was the case with Morrisons supermarkets [in 2014].”

Most large organisations have proprietary data protection and security software in place that can detect and limit large transfers of data between systems, but they are not the usual targets for cybercriminals. 

“Smaller businesses remain a challenge partly because they believe themselves to be too small to be targeted,” Hookham says. “Wrong – they are the way into the bigger systems.”

How can businesses protect themselves?

Supply chain cyber security breaches create regulatory headaches for organisations, Hookham explains. “Data losses of personal information must be reported to the data protection agencies under EU and UK data protection law, which immediately puts senior management in the frame and becomes a massive distraction from day-to-day business, and in serious cases, you will face an investigation by the data protection agencies that is on par with a tax investigation.” 

Hookham advises smaller companies within large supply chains to get professional advice. “The criminals know more than you do.”

Farrell recommends controls proportionate to the sensitivity of the information and the importance of the operation throughout the supply chain. As a first step, he recommends identifying the suppliers and systems whose failure would most affect operations; map the information they hold, the access they need, and their critical subcontractors and use that assessment to prioritise scrutiny.

Before contracts are awarded, Farrell says it’s important to bring procurement, IT security and operational teams together, establish requirements and named responsibility for software support, security updates, incident notification and recovery. “Supplier access should be limited to what is necessary, reviewed regularly and removed when no longer required. Security requirements should also extend to relevant subcontractors.” 

Finally, seek evidence that arrangements work throughout the relationship, Farrell advises. “Review critical suppliers, follow up identified weaknesses and rehearse how the business would respond to a supplier outage, because procurement’s role continues long after the contract is signed.”