Supply chain attacks have become the most prevalent cyberthreat confronting businesses over the past year, according to a new Kaspersky global study. The findings show that nearly one-third of companies worldwide experienced a supply chain threat in the past year.
According to recent data from the World Economic Forum, nearly two-thirds (65%) of large enterprises indicate third-party and supply chain vulnerabilities as their greatest barriers to cyber resilience in today’s interconnected digital landscape. A Kaspersky-commissioned global study examined how these risks are evolving and the extent to which businesses worldwide are exposed.
Kaspersky’s survey showed that 31% of enterprises globally had been impacted by a supply chain attack in the past 12 months, more than any other type of cyberthreat. The supply chain threat is acutely focused on the most connected organisations, with large enterprises reporting the highest rate of attacks experienced (36%) compared to counterparts in low- and mid-sized enterprises.
It is noteworthy that the same group of enterprises report having the highest mean number of software and hardware suppliers, managing around 100 suppliers on average, which creates a vast potential attack surface. On top of that, organisations admit to granting access to their organisations’ systems to dozens of contractors; while low enterprises average about 50 contractors, for high enterprises the figure skyrockets to more than 130, facilitating another cyber risk deriving from the digital space interdependence — trusted relationship attacks, during which attackers might exploit legitimate connections between organisations.
Over the past year, trusted relationship attacks affected a quarter (25%) of companies globally. Most frequently, attacks abusing existing connections between organisations were suffered by organisations in Turkey (35%), Singapore (33%) and Mexico (31%).
“We are operating in a digital ecosystem where every connection, every supplier, every integration becomes part of our security profile,” comments Sergey Soldatov, head of security operations centre at Kaspersky. “As organisations grow more interconnected, their exposure to attacks grows with them. Against this landscape, protecting the modern enterprise now demands an ecosystem wide approach that strengthens, not just individual systems, but the entire network of relationships that keep business operating.”
Only by implementing preventive measures across the organisation and approaching partnerships with suppliers and contractors strategically can companies reduce supply chain risks and ensure business resilience.
For mitigating such risks, Kaspersky recommends the following:
• Thoroughly evaluate suppliers before entering a deal. Check their cybersecurity policies, information about past incidents and compliance with industry security standards. For software and cloud services, it is also recommended to review vulnerability data and penetration tests.
• Implement contractual security requirements. Complete regular security audits, and ensure compliance with your organisation’s relevant security policies and incident notification protocols.
• Adopt preventive technological measures. Implement security practices such as the principle of least privilege, zero trust and mature identity management to reduce damage if the supplier is compromised.
• Ensure continuous monitoring. Use solutions for real-time infrastructure monitoring and anomaly detection in software and network traffic, depending on the availability of in-house staff capable of performing such monitoring.
• Develop an incident response plan. Make sure it covers supply chain attacks and includes steps to quickly identify and contain breaches — for example, by disconnecting the supplier from company systems.
• Collaborate with suppliers on security issues. Strengthen protection on both sides and make it a shared priority.
More recommendations, along with other findings on business exposure to supply chain attacks, are available here.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version