Author: Alexandre Palma
For the existence of all businesses, it is indispensable to structure a supply chain. The supply chain is all the processes generated from when the customer makes an order until the product or service is delivered and paid for. Therefore, the supply chain comprises the planning, execution, and control of all activities related to the flow of materials. This includes information from the purchase of raw materials to the final delivery of the product to the customer through its intermediate transformation.
Throughout this process, technology is always present in several stages. This depends on the size of the company, the complexity, and the chain extension.
A very common example is AI use within the supply chain. AI use consists of different technology options that help businesses understand complex information and enhance human performance by taking over time-consuming and routine tasks.
Currently, AI enables more visibility and integration across networks, which allows brands to expand their supply chain while keeping everything streamlined. It works by using algorithms to detect patterns, trends, and gaps across an entire supply chain (which also plays a role in accurate forecasting).
The “technology” is used for 3 main needs in the supply chain:
Data capture and management – With increasingly extensive and complex supply chains, information management has become essential in dealing with market demand. In this sense, it is essential to ensure the accuracy of the data in the management of stocks, the traceability of goods, and the exhaustive monitoring of KPIs.
Greater integration between different elements in the supply chain – This is achieved through the standardization of processes and the planning of joint activities. The use of advanced software for information management is essential to stop operating separately and address the supply chain more globally.
Automation of processes for greater accuracy and speed – Industrial automation that is already applied to the manufacturing and processing of products has improved the supply chain and is present in the different areas of logistics (Management of warehouse activity: Automated transport of cargo in intralogistics processes: Management of transport routes).
Being technology, this is constantly in the crosshairs of cyber attackers. A 2020 audit conducted by Synopsys found that 49% of commercial codebases use open-source components that have high-risk vulnerabilities. If attackers were to exploit these vulnerabilities, they could compromise thousands or even millions of companies across industries and around the world.
A Supply Chain Attack could be defined as “an intentional malicious action (e.g., insertion, substitution, or modification) taken to create and exploit a vulnerability in Information and Communication Technology (hardware/software/firmware) at any point within the supply chain with the primary goal of disrupting or surveilling a mission using cyber resources.”
For example, the security firm Sonatype estimated that there were over 400% more supply chain attacks between July 2019 and March 2020 than in the previous four years combined.
Here are some tips on how you can “protect” your supply chain:
- Relying more on automated tools to fix simple vulnerabilities.
Online code repository GitHub has developed “automated robot code” that identifies and fixes users’ simple vulnerabilities with one click of a button. With SBOMs becoming prevalent, similar services will be developed. However, few businesses have implemented these novel tools into their IT workflows. Only 42 of the 1,896 GitHub users who were contacted about one vulnerability accepted the automated patch. This must change.
- Procurers should demand that critical technology vendors implement “hot patching”.
Some technologies, such as the industrial control systems that run factories and the software that manages power grids and water distribution networks are so pivotal that they cannot fail. Businesses want them to be free of any known vulnerability, regardless of how exploitable they think the vulnerability is. But these systems must also always be available. Cybersecurity updates would be infrequent if they needed to be shut down to be patched because businesses and governments can rarely afford to take them offline.
Therefore, businesses should demand that their vendors implement hot patching systems, enabling them to deploy patches without rebooting their software. While implementing this functionality may increase costs, it will also ensure that businesses don’t have to choose between cybersecurity and availability.
- Businesses should conduct a cost-benefit analysis for vulnerability patching.
A lot of vulnerabilities won’t be so easy to remediate. Many products can only be patched when their systems are offline. Fixing every vulnerability is therefore impractical. Thankfully, it isn’t necessary. Not all vulnerabilities are created equal: Some are very costly to weaponize and are thus unlikely to be exploited.
Businesses can use newly created metrics to triage vulnerabilities. For instance, the Exploit Prediction Scoring System (EPSS), developed by a team of cybersecurity experts and software vendors, estimates the probability that a vulnerability will be exploited based on its inherent characteristics. This tool will help risk managers determine whether the cybersecurity benefits of fixing a vulnerability outstrip the disruptions that remediation will cause.
- Doing regular audits.
Gaining access to sensitive data is often the main reason behind all supply chain attacks. You should take all necessary steps to protect your data, finding out where you live and who has access to it. This will help determine how you are interconnected with your suppliers and what data and systems you share. In addition to conducting an audit of your network, you should also regularly audit the activity of your third-party supplier. This will ensure that everyone is following the appropriate security controls and will help identify any vulnerabilities.
- Management and control by third parties.
Regular monitoring activity between your organization and third-party suppliers is essential. This will help identify any unusual or suspicious activity. Recording activities on network devices and endpoints will make it easier to detect any anomalies that prove invaluable in the event of a breach
So that was a summary of some significant strategies for preventing such attacks. The risk of cyber-attacks is omnipresent, there are lots of threats in the cyber field and the number of attacks increases daily. Never forget that a supply chain is a mutual and interdependent cycle; if something happens to one of the agents at some stage, the supply chain could suffer critical damage.
And remember, prevention is better than cure.