Request a Demo

Fill in the form below and we will contact you shortly to organised your personalised demonstration of the Noggin platform.

The Noggin Platform

The world's leading integrated resilience workspace for risk and business continuity management, operational resilience, incident & crisis management, and security & safety operations.

Learn More
Resilience Management Buyers Guide - Thumbnail
A Resilience Management Software Buyer's Guide
Access the Guide

Who We Are

The world’s leading platform for integrated safety & security management.

Learn More

How Supply Chain Attacks Are Exacerbating the Threat Landscape

Everyone’s talking about the supply chain crisis: overloaded ports, striking truck drivers, shuttered factories to deal with the Delta variant. But there’s another threat facing our supply chains. Supply chain attacks are on the rise, as well. What’s the cybersecurity threat landscape for supply chains look like? 

Supply chain attacks on the rise

According to late July report from the European Union Agency for Cybersecurity (ENISA), the threat landscape looks bad – very bad and likely to get worse.

How so? The report, entitled Thread Landscape for Supply Chain Attacks, analysed 24 incidents, coming up with a troubling conclusion; turns out, strong security protections aren’t enough when bad actors shift their focus to suppliers.

Underscoring the threat risk are projections that supply chain attacks are set to multiply by a factor of four this year (compared to 2020). In the words of Juhan Lepassaar, EU Agency for Cybersecurity Executive Director:

Due to the cascading effect of supply chain attacks, threat actors can cause widespread damage affecting businesses and their customers all at once. With good practices and coordinated actions at EU level, Member States will be able to reach a similar level of capabilities raising the common level of cybersecurity in the EU.

Download Guide to Improving Supply Chain Resilience after the Blocked Suez Canal IncidentAdditional challenges to preventing supply chain attacks

Further, the threat is so distressing, because organisations are only as protected as their suppliers, whom attackers can target. Indeed, to compromise organisations, attackers have been doing just that – using a suppliers’ code in about 66 per cent of incidents.

Even worse, in two thirds of supply chain attacks, suppliers didn’t know or failed to report on how they were compromised. The gap in maturity in cybersecurity incident reporting between suppliers and their customers was also found to be staggering.

Another issue picked up in the report: in nearly 60 per cent of supply chain incidents, customer assets targeted were predominantly customer data.

Measures to combat the risk of supply chain attacks

Besides validating third-party code and software, what else can organisations do to combat the supply chain threat? The report lays out recommendations for EU member states, customers (or individual organisations), and suppliers.

For the customers and suppliers, respectively, recommendations include:

For customers:

For suppliers:

  • Identifying and documenting suppliers and service providers
  • Defining risk criteria for different types of suppliers and services such as supplier & customer dependencies, critical software dependencies, single points of failure
  • Monitoring of supply chain risks and threats
  • Managing suppliers over the whole lifecycle of a product or service, including procedures to handle end-of-life products or components
  • Classifying of assets and information shared with or accessible to suppliers, and defining relevant procedures for accessing and handling them.
  • Ensuring that the infrastructure used to design, develop, manufacture, and deliver products, components and services follows cybersecurity practices
  • Implementing a product development, maintenance and support process that is consistent with commonly accepted product development processes
  • Monitoring of security vulnerabilities reported by internal and external sources that includes used third-party components
  • Maintaining an inventory of assets that includes patch-relevant information.

Finally, the supply chain risk isn’t just that goods aren’t getting where they need to go. Providers are being targeted by cyber actors, too. Organisations and consumers who rely on those providers need to be prepared, updating their crisis and business continuity plans to reflect the threat. For more on how to go about it, download our guide to the Suez Canal Blockage crisis.

Download Guide to Improving Supply Chain Resilience after the Blocked Suez Canal Incident