[ This article was originally published here ]
Some of the biggest prevailing challenges in the cybersecurity world over the last year have been those revolving around securing the software supply chain across the enterprise. The software that enterprises build for internal use and external consumption by their customers is increasingly made up of third-party components and code that can put applications at risk if they aren’t properly secured.
It’s a problem that cuts across every industry, but manufacturers are feeling it especially acutely because they’re tasked with securing not only the software supply chain but the physical supply chain as well. It’s a very layered risk issue for manufacturers for two big reasons.
First of all, the things that manufacturers produce today are increasingly connected and more software dependent than ever before. They depend on a host of specialized silicon and digital components that are invariably produced by third-party manufactures themselves, creating a nested chain of third-, fourth-, and Nth-party dependencies that are difficult to track, let alone manage risk against.
Secondly, the factory floor itself is a part of the supply chain that is becoming more intricately converged with the IT network and which is highly dependent on third-party equipment, software, and remote connections.
Given these factors, it becomes clear that managing cybersecurity risk across the supply chain will require manufacturers to carefully attend to the risk brought to the table by their third-party suppliers and contractors. And on the flip side, many manufacturers who provide components to clients who are also manufacturers must stay vigilant as security standards rise for what it takes to get their products in the door elsewhere.
“As I’ve been doing in-depth interviews for our and also doing customer calls, one of the things I’ve observed about manufacturers in the supply chain is that even when they’re smaller—say, 50- to 100-person shops—they’re still saying, ‘Security is critical to us,’” says Theresa Lanowitz, security evangelist for AT&T. “They know they need to be doing everything they can to abide by their customers’ security guidelines, external rules and regulations, and mitigating the risk required to keep the entire supply chain secure.”
It’s an issue that cybersecurity experts at AT&T like Lanowitz and those at Palo Alto Networks have increasingly been collaborating on to help manufacturing customers address across their organizations. The following are some tips they recommend for manufacturers managing third-party cyber risk in the supply chain.
Because digital components and hardware are so woven into the products that supply chain providers deliver to their manufacturing clients, risk scores and signals matter more than ever. According to Dharminder Debisarun, worldwide industry security architect for manufacturing, Internet of Things and transport at Palo Alto Networks, it’s up to companies determine what their risk appetite is for their providers—depending especially on what they’re delivering to the supply chain—and start finding ways to get transparency into that.
“Ask yourself, ‘What’s our risk appetite for suppliers that we work with?’” he says. “You want to know that before you engage with them. Then there needs to be some kind of framework or certification that says ‘Hey, this company is secure enough to do business with’.”
He says some governments have provided that kind of grounding—for example in Germany the automotive industry relies on the to prove out baseline security proficiency. Barring that, the growing world of third-party risk management monitoring is another place to start getting transparency. Ultimately, the goal is to do third-party screening of every bit of coding or connectivity delivered by suppliers into a manufacturer’s supply chain or production streams.
Even more important, says Debisarun is that manufacturers ensure that their cyber security standards are enforced contractually.
“You can only work this out contractually. You need to have cybersecurity and cyber risk requirements embedded into all the supplier contracts you put in place,” he says. “It’s something manufacturers should really consider doing.”
Some of the things that should be enforced include disclosure of big security incidents or material software vulnerabilities, how remote access is established and maintained between supplier and manufacturer, how and when security audits or certifications are provided, and so on.
Meantime, because the actual manufacturing capability of organizations is so intertwined with third parties, managing factory floor vendors securely is crucial. Debisarun explains that the assembly line floor today is almost never managed by the manufacturer itself.
“It’s going to be an assembly line floor run by Siemens or Rockwell or ABB. And when these assembly lines are delivered by these giants of the manufacturer ecosystem, they will never allow the customer to do maintenance on that assembly line,” he says, explaining that big vendors contractually require that they handle the maintenance on this equipment.
In most cases, this requires remote access—especially now in this post-COVID world.
“At which point the manufacturer is flying blind,” he says.
This highlights the importance of setting up mitigating controls like secure remote access and architecture that creates a pathway for the manufacturer to at least control the traffic in their network. At the core of SASE is Zero which combines fine-grained, least-privileged access with continuous trust verification and deep, ongoing security inspection to protect all users, devices, apps, and data everywhere – all from a simple unified product. This is an integral and oft-forgotten part of managing third-party risk in the manufacturing world.
Finally, organizations should be architecting their supply chain and coordinating their vendor management to keep cyber resilience top-of-mind. According to Lanowitz, the key is remembering the concept of eliminating ‘single points of failure.’
“If you are a major car manufacturer, for example, and you’re using tiny suppliers to help you build out your cars, you want to make sure that if they go out of business, if there’s a fire in their plant, or their operations are interrupted by ransomware, you’re not going to need to stop your assembly line waiting for them,” she says.
Debisarun agrees, explaining that every manufacturer should have a plan B and C for when cybersecurity events at suppliers create downstream impact.
“If one supplier breached, how long should you wait to it’s resolved?” And that basically comes back to the contracts you are signing—the plan needs to be built into that so you aren’t dependent on one supplier’s readiness to handle a cyber event or a physical event,” he says.
Ad