The Counter Ransomware Initiative and its Private Sector Advisory Panel, made up of cyber and tech companies, has issued the advice encouraging businesses to better defend themselves against a threat that has been so successful for cybercriminals over the past few months. As we saw with the hacks that impacted Jaguar Land Rover, Co-op and Marks and Spencer, cyber criminals are increasingly looking at initially attacking supply chain partners to gain access to their primary target’s systems.
The JLR attack in particular highlighted the impact such an attack can have, putting the car manufacturer out of action for weeks, costing it an incredible £1.9 billion. So, whilst the advice from the government and its associated private sector advisors can be welcomed, it does not offer any practical advice.
Understanding where the vulnerabilities lie within your third party and even fourth party partners is for most companies, no matter what size, a daunting if not impossible task. Too many are just hoping they will not be impacted by such a breach and this latest advice will do little to help them as AJ Thompson, CCO at Northdoor plc explains:
"There is little doubt that supply chain attacks are now the most effective method cybercriminals are using to gain access to data and systems. The attacks against the high-profile targets over the past few months has really increased the spotlight on the attacks and should have acted as wake-up call to all businesses.
"The issue is that most supply chains are now so large and complex, understanding where vulnerabilities lie within third parties or even further down the line is for most an impossible task. Therefore, advice from the Government is welcomed, but it needs to be more proactive, less bland, than what we have seen so far.
"Without insight as to where the weaknesses lie within supply chains companies are essentially leaving the back-door open, no matter what they spend on frontline defences.
"The advice from the Government is based on the traditional method of collecting information from supply chain partners, relying on questionnaires and the honesty and knowledge of the partner. Such an approach cannot provide the level of insight needed to protect against such sophisticated attacks.
"Many companies are instead turning to AI generated solutions that can provide a 360-degree view of where vulnerabilities lie within supply chains, giving them the information needed to ensure such gaps are closed before cybercriminals can take advantage of them.
"The Government and companies need to appreciate that the response to supply chain attacks needs to be on par with the sophistication that the cybercriminals are using. This does not means a huge expense, but instead a new way of thinking about how to use technology to counter the threat, not hanging onto old, outdated methods," Thompson concluded.
