Supply Chain Attack: What Businesses Need to Know

What is a Supply Chain Attack?

The majority of growing businesses work with a variety of partners and third party vendors in various different ways. Exchanging large amounts of data with other partners (such as integrations and customer details) heightens the security risk. With supply chains, deliberate cyber attacks normally involving Malware can easily reach the businesses in the chain through a number of vulnerable access points.

Accenture the global management consultancy recently released a report that over half of cyber attacks are delivered in the form of a supply chain and claim that over 60% of cyber attacks originate from entities that are part of the extended supply chain, or by external parties exploiting security vulnerabilities within the chain itself.

It’s important to note that the security of a supply chain is only as strong as the weakest member of the chain, cyber criminals identify the vulnerabilities of the weakest member to gain access to the other members of the supply chain.

These are worrying statistics for UK businesses considering GDPR is now in play. With the GDPR, a Supply Chain Attack that results in a data security breach could mean businesses are liable to a fine of up to 4% of annual turnover.

How are supply chains attacked?

Supply Chain Attacks commonly occur from third party software providers, third party data storage, websites and watering holes which are all used to distribute Malware. We briefly explore each method below.

Third party software providers

Attacks occur through malicious Malware or counterfeit components embedded in to software stored in repositories that businesses regard as secure. The software is then downloaded by users which then installs both the software and malicious Malware within it. With the compromised software being very difficult to detect if it has been altered at the source there is little clues for security teams to suspect it’s not legitimate. This year, the Petya Ransomware outbreak hit businesses globally infecting millions of computers.