Supply chain attacks have been in the spotlight for quite some time now. All thanks to the high-profile attack cases of Log4j, Kaseya VSA (REvil) and the SolarWinds SUNBURST. However, today, it isn’t just affecting a handful of enterprises. The attacks are growing more than ever.
According to Gartner, 45% of companies are likely to experience a supply chain attack by 2025. So, don’t you think it’s time to learn how to deal with it?
Here are 3 main blind spots that may leave you open to supply chain vulnerabilities.
Blind Spot #1. Pathways for Application Server and Software Updates
The most common way of software-based supply chain attacks in an enterprise is through the update mechanism. The attackers use the mechanism as a “delivery pathway” to transfer ransomware to the updated servers.
Here, the solution is to do a complete behavioral analysis of the application servers. Devices with malicious software updates are likely to behave differently than normal. You may have a hard time spotting the behavior if the ransomware is developed by a sophisticated attacker. But if you have a good behavioral analysis system in place, any aberration would hardly go unnoticed. So, make sure you have one.
Blind Spot #2. Cloud Infrastructure and User Behavior
Organizations that use any public cloud providers like Google Cloud Platform, Microsoft Azure or AWS must comply with its benefits as well as risks. You must understand if your cloud provider gets compromised for some reason, so shall your data.
So, if you see a malicious outsider who has access to your credentials or an insider who is using their own credentials to steal information, then the only way to solve this is through behavioral analysis.
Another way to defend against the supply chain attack is by using Machine Learning (ML) and Artificial Intelligence (AI) to detect anomalies. But to make this work, you’ll first have to create baselines for data flows and business-critical devices.
Blind Spot #3. BYOD (Buy Your Own Device) or Unsanctioned Devices
Keeping the malware out of your environment is a challenge in itself. But what if the malware comes pre-loaded on your device?
Most organizations don’t even have a clue about the inventory of devices linked to their network nor do they have any idea about the software they run. So that’s a huge blind spot that puts their supply chain at risk.
In that case, the first step you need to take is to look for the affected devices. The process may turn out to be extremely difficult but you must do it. Or else, the attackers will continue expanding their access and can cause real harm to your environment.
As supply chain breaches will continue to happen in the future, it’s high time for organizations to embrace the solutions discussed here.
You might be pretty confident about the prevention strategy you’ve in place. However, it is still important to take necessary measures to identify and respond if there is any exploitation of vulnerable software. So, in case there’s still a successful exploit, you can at least mitigate and recover quickly.
