Supply Chains Under Siege: Adopting a Zero Trust Approach to Vendor Management

In recent years, supply chains have come under siege from hackers. The disruption caused by COVID-19 highlighted the fragility of global supply chains, and now, four years later, supply chains are being hacked.

Understanding Supply Chains

When most people think about a supply chain, they think of manufacturing, logistics, and customers. However, supply chains can revolve around any product, both physical and digital, and exist in every industry, including technology, software, healthcare, and financial services.

The Threat of Supply Chain Attacks

Supply chain attacks have become increasingly common, surpassing the number of malware-based attacks by 40% in 2022. There are two main types of supply chain attacks: pivoting attacks and disruptive attacks.

Pivoting Attacks

In a pivot attack, an attacker targets a link in the chain to gain backdoor access to their real target. A prime example of this is the Kaseya attack, where attackers exploited a vulnerability in a remote management tool created by the software company Kaseya. Once they hacked Kaseya, they deployed ransomware to lock down the systems of everyone who used Kaseya's product, causing many to go out of business.

Disruptive Attacks

Disruptive attacks focus on forcing victims to pay the ransom by threatening to continue to disrupt their operations. An example of this is the attack on Change Healthcare, a subsidiary of United Health Group. The ransomware attack resulted in one of the most serious attacks on the healthcare system in U.S. history, with many healthcare organizations unable to transmit patient claims. Change Healthcare eventually paid the hackers $22 million in Bitcoin to stop disrupting their operations.

Protecting Your Supply Chain

The key to protecting your supply chain is to adopt a zero-trust approach to vendor management. This means doing your due diligence to determine a vendor's trustworthiness. Look for common vendor security certifications and be wary of red flags such as incomplete or vague policies, outdated security practices, hidden costs, and poor communication.

In the event of a vendor breach, it's important to have a plan in place. This should include immediate notification and containment, assessment and investigation, risk eradication and mitigation, stakeholder communication, recovery and review, and vendor reevaluation and monitoring.

Supply chains can exist in every industry and are prime targets for hackers. By doing your due diligence and adopting a zero-trust approach to vendor management, you can help keep your supply chain secure.