Tips to Improve Your Digital Secure Supply Chain

You probably feel confident in your online security. You’ve made the effort to reduce threats, address risk factors to your business, and protect your organization’s data. What could possibly be left to deal with? Now you have to work toward a secure supply chain.

Unfortunately, there are several places in the digital supply chain that pose potential risks, and securing those can be difficult if you’re not proactive. Regardless of your security procedures, another business might make a mistake that filters through to you. Threats can be introduced in any part of the supply chain between the manufacturer and your company.

Fortunately, there are ways that you can mitigate those risks and even help secure the supply chain for other organizations.

Other Supply Chain Security Breaches

Late last year, digital security company FireEye was the victim of a data breach. A backdoor, later named “SUNBURST” was installed on their system via malware in an update to network management software Orion. The malware was installed on Orion’s side, and the data sent out to their customers contaminated approximately 18,000 business interests and government organizations. 

The 2013 Target Breach

Of course, this is only the latest, high-profile supply chain threat to come to light. Back in 2013, Target had one of the most devastating cyberattacks performed on them. You might not remember, but the credit card and customer data of roughly 70 million customers were stolen. How did these nefarious hackers get into the system of an enormous business like Target? They went up the supply chains and found a vulnerability that got them the security credentials of an HVAC supplier that used a third-party portal.

Even though this was ultimately a good thing for InfoSec, hastening the adoption of more secure chip readers in retail, it revealed something new about supply chain security. Security researcher David Harley put it best. “I guess (or hope) that people in general and certainly the InfoSec community became more aware that it’s not just the security of the companies that you do business with that you should worry about: it’s also the security of other companies that they do business with. [Organizations] you consider trustworthy is one thing, but who do they trust? We take it for granted that we live in an interconnected world, but don’t necessarily realize just how extensive those interconnections really are.”

When you rely on vendors to supply you with software, it’s important that they be as aware of threats as you. That means being aware of your supply chains and demanding that they take risks as seriously as you do.

Supply Chain Risk

What parts of your supply chain are vulnerable and how do you secure those?

Supply chain security starts with chipset manufacturers. The physical hardware that your business runs on needs embedded code to help it effectively process data. That means there’s a risk that threats can be introduced directly into the chips themselves, requiring later firmware updates to secure them.

Next, there is a complex web of software to be aware of. Some of the most common threat vectors are vulnerabilities introduced in software updates. Unlike with SUNBURST, a risk like this is rarely intentionally added by organizations. Rather, trying to fix one problem might lead to introducing a new, previously unknown risk.

Other vendors with even limited access to part of your supply chain might introduce security threats, too. Like with Target, it’s possible that somebody else’s data can carve a path right to your business.

Fortunately, there are ways to mitigate the risk these threats pose.

Securing Your Supply Chain

Here are our top supply chain security tips so your data remains safe and your risk minimal.

Be Aware of Your Systems

The very first thing your business should do is make a detailed list of what hardware and software you’re using. Learn their supply chains and where they fit in yours. Research what supply chain security methods they employ to limit unnecessary risk. Know the kind of threats they might face. Having a complete understanding of your equipment is the easiest, most immediate way to lock down your digital supply chain.

Work with Your Suppliers

The people who supply you with the tools you need to run your business don’t want to risk a security breach any more than you do. If anything, their reputation relies on accurate data about their security plan. That’s why a good supply chain security action item is to talk with your vendors about their supply chain and how they keep threats from compromising organizations that work with them. You can request code audits, ask for penetration testing, and even set concrete security requirements before signing any contracts.

Get Rid of Old Systems

It can sometimes be difficult to make the effort of removing old or outdated tools from your business network, but it’s crucial to supply chain security. Actively used and supported solutions can respond to risk and send an update. However, organizations that have gone out of business or stopped supporting a particular product no longer update their software or firmware. That means any newly discovered vulnerabilities will always be there, waiting for somebody to exploit them. Moreover, tools you no longer use are just risk factors sitting on your system for no reason. Be smart about supply chain security and get rid of those immediately.

Stay Alert

Since supply chain security issues can change from day to day, it’s important that you remain aware of them. Setting up Google alerts for your various software and hardware with words like “breach,” “hack,” “vulnerability,” etc. strengthens your supply chain by making sure you can make smarter decisions with your data.

Use Your #SecurityHygiene Plan

It should go without saying (but we will anyway): effective supply chain security requires good security software. That means organizations should protect their data with smart processes, like requiring two-factor authentication, and reliable supply chain security tools. These include general security software with multiple layers of protection, data verification software, and of course, a VPN. In this case, the VPN’s secure encryption tunnel can plug several potential data leaks before they become an issue.

Control What You Can

It’s impossible to achieve 100% supply chain security. Even if you write all of your software in-house and assemble your own computers, your data could still be at risk from firmware exploits. Plus, it’s nearly impossible (and not your job) to micromanage your vendors.

Instead, control the parts of your supply chain that you have access to. Take the time to learn what you can do about supply chain security at your end. Institute policies to deal with threats and hire smart IT people who know how to respond to a crisis. It doesn’t take a lot to ensure that you have a secure supply chain, or at least, as secure as one can be.