There are two main reasons why supply chain attacks are on the increase. First, there is a general trend of companies outsourcing more critical business functions to external providers, and doing so often makes good business sense.
Secondly, while threat actors’ focus and methods remain the same, they target the weakest link. Outsourcing has led to increased suppliers, which is now becoming an organisation’s weakest link, and the threat actors know it.
Most organisations find suppliers challenging because they are outside their direct control. It is much easier to look at and control when it is inside the perimeter. It’s much more challenging to ensure the safety of any third parties we do business with.
The problem with Third-Party Risk Management.
The challenge with how people run their TPRM program is that it is often treated as a governance and compliance exercise. The overall goal then becomes to demonstrate that we provide adequate assurance rather than pursuing the fundamental objective of reducing security risks.
It means that people don’t see it as constructive and valuable, creating a vicious cycle in which, because people see it as a necessity for compliance, they don’t put the required effort into it, which means the value depreciates. We need to break free from that vicious cycle and take a different approach to make it more effective and reduce the challenges.
Embracing a More Robust and Collaborative Approach with Our Suppliers.
We need to start with open and transparent communication channels with our suppliers early in the relationship. Approaching our conversations with suppliers from the angle of an audit assurance process incentivises them to be less forthcoming with their information, especially when discussing security weaknesses. They often don’t want to open up about their weak points because they’re trying to win or retain a contract, and you don’t get an accurate view of their security posture.
So it’s creating those communication channels, creating a trusted relationship with your suppliers right from the beginning, so that when something happens, we have these relationships in place and can quickly collaborate on threats when they arise and reduce the impact of incidents as much as possible. These relationships, however, have to be built with the security teams at our suppliers – our natural allies – and not with customer success teams that traditional TPRM programmes or procurement teams would mainly be interacting with.
Moving Third-Party Risk Management into SecOps.
Crucially, however, we need to start approaching TPRM as an operational challenge rather than a pure governance one and involve our Security Operations teams. The first point of call is talking to in-house threat intelligence teams or external providers. Raising and utilising critical threat intelligence data to appreciate where our suppliers sit and what risks they could face is incredibly useful for responding to attacks in an operational way.
Third-party risk management and incident response are usually split between the Governance and the SecOps teams, which is not a helpful way to look at the problem of how to reduce the likelihood and impacts of attacks against our corporate supply chains. It raises the question: What do we do when a supply chain incident strikes? Do we have to contact our Governance, Risk and Compliance (GRC) teams since they are supposed to have a relationship with the suppliers in question, or should this be our SecOps teams responsible for handling the incident response?
It can work if TPRM programmes build a comprehensive database of suppliers and establish collaborative relationships with their security teams. Every supplier assurance review is a real opportunity to gather threat intelligence data on our suppliers and develop strong relationships, helping us build that comprehensive database of security data and create alliances.
So when an incident happens in the future, whether there’s an incident at that supplier in particular or a more industry-wide incident such as the MOVEit Transfer attack, we are in the position to quickly reach out and collaboratively address any problems in partnership with that supplier. It also allows you to build a system where you can quickly search and draw insights from our databases to ascertain which suppliers in your ecosystem could be most vulnerable to a specific attack, or what kind of risks they could pose to us if affected, which will further increase our ability to respond to attacks when they strike quickly.
Conclusion.
As an industry, we are learning that collaboration between organisations, whether within a sector, across geographies or industries, and crucially with our suppliers, is not only important but also the key to success when dealing with a security incident.
We witnessed a sea change when the Solarwinds attack happened a few years ago, and security experts realised that one organisation could not address this problem alone. If we look at the SolarWinds incident, numerous organisations in that supply chain ecosystem were affected by the fallout, and it was only through collating data that they held between them that we could learn the routes the attackers had taken and what had transpired.
Especially with so much outsourcing happening today in the context of rapid digitalisation of business processes, we need to find ways to collaborate more effectively and overcome barriers like commercial competition between our organisations and legal obstacles to realise that we are all in this together and that we have to Defend-as-One to stand a chance against increasingly sophisticated threat actors and an ever-growing attack surface.
Finally, we must consider supply chain security not only as a compliance exercise but also as a critical operational problem. Only by shifting TPRM into the operational space will we have a tangible impact on our ability to prevent and respond to supply chain incidents when they happen.
About the Author
Emily Hodges is Chief Operating Officer at Risk Ledger, a UK-based startup working to secure the global supply chain ecosystem. With a background in mathematics and cryptography, Emily spent a few years in PwC’s cyber security consulting practice before starting a new consultancy aimed at using human understanding to make tangible improvements to security. She is now driving a step change in supply chain security, challenging the status quo with Risk Ledger.
Emily Hodges can be reached online at [email protected], https://www.linkedin.com/in/emhodges/ and at our company website https://riskledger.com/index.html