Top 10 Things the Industry Can Do Now to Mitigate Digital Supply-Chain Attacks

Today, we're going to chat about the hot cybersecurity topic of third-party and supply chain attacks and go over the top 10 things the industry can do now to make a difference. Now, last week I was speaking on an executive panel at the 2021 HMG Live New York CISO Executive Summit, uh, Leadership Summit. And the panel, which included Ajoy Kumar, uh, who's the head of IT risk analysis and reporting for the Depository Trust and Clearing Corporation, Uh, it also included Min Karianis, the managing director of EMD, and Ruta Almedia, the CISO of Delta Dental for New Jersey and Connecticut. Now we all discussed how in the wake of SolarWinds, it has been a supply chain awakening for CISOs and business leaders. It was only a brief 20-minute panel, and I recommend everybody should go out and check it out. But I wanted to cover my recommendations a little more in depth, which we're gonna do right now. But let's set the foundation. The SolarWinds attack, which really came to light in the early part of 2021, and I personally believe is the hack of the decade, has been a wake-up call for the CISOs and business leaders, prompting them to review their supply chain dependencies and risks much more aggressively. With SolarWinds, almost all of the Fortune 500 companies, many of the major U.S. government agencies including Defense and Treasury, Justice, Commerce, Department of State, Homeland Security, and the White House— they were breached. So this is pretty significant. And additionally, out of all of that, the national critical infrastructures for the U.S. were also exposed. Now, given this level of access, this attack could have been absolutely devastating. Lucky for everyone, this particular attacker was only looking to gather information, not actually cause irreparable damage, but they could have. So that's where everybody is really nervous at this situation, and that's why everyone's taking a look at at these supply chains and third-party risks, because this is what SolarWinds was really about. And at a strategic level, we need to realize a few things. First off, supply chain and third-party risks, they're huge. And in fact, they're growing even more. The more we adopt digital technology and bring it into our companies and our homes and our lives, the greater the risk. And it is not just a single vulnerability or a single vendor, but rather all the vendors, all the digital products, and all the services. That's what represents the real risk here. So, you know, most of these attacks, uh, are generated from nation-states right now, but the technology and the learnings from that trickle down, and we're going to see vulnerabilities and exploitations even from just cyber criminals. We are expecting more attacks based upon the fact that this was hugely successful. And I guarantee you every nation-state out there with an offensive cyber team is prioritizing these types of attacks given the success of SolarWinds. So this is a dream come true and everybody's going to be pursuing it. So we expect many more attacks against many more vendors. And, and the industry right now, well, we're still struggling with how to dramatically improve the situation. The supply chain environment was never really designed to be this trustworthy, and it's a gaping hole. There is no easy solution. Overall, what's needed is better everything, better controls, better communication, better collaboration among suppliers and customers. So this is a big challenge, and this is something that the industry is going to struggle with for at least a few years to try and get our arms around it. So let's jump in to the top 10. Now, these are things that the entire industry must work together to change the ecosystem to be more secure, but it's things we can actually start doing now, making a difference Now, all right, let's start off from the customer's perspective. These are the organizations that are bringing in and buying and using cloud services and IT services and everything else, right? Whether it's products or services, doesn't matter. Now, the goal really for the customer is to prevent the ingress through these partners, right, and suppliers. And once that happens, right, you also wanna stop the east-west or the lateral movement if a compromise does actually occur. So you're looking for both things. Prevent as much as you can, and for the ones that you can't prevent, you want to make sure that they can't navigate easily within your environment and cause more harm and open up more backdoors. Okay, so let's jump into number 1. The first thing that we have to do is we have to understand the risks of this type of an attack and the fact that it will increase. And we have to, to get our head around that, especially the CISO and the cybersecurity teams, so that they can incorporate the cybersecurity risk into the modeling that they do. And that should impact the corporate policy, the security policy, the vetting of vendors, employee training, crisis response exercises, budgets, and even security metrics. So understanding those risks, because it does change, um, you know, how you see that in the organization, and it's going to shift some priorities, right? That has to be accounted for in a formal, comprehensive way. So that's the first thing, and it's really up to the CISO to make that happen. Okay, the second thing is we have to scrutinize the vendors more carefully. Most companies don't do a very good job at this to begin with. Some of them ask a few questions, some of them look to see if their vendor has some type of certificate, which there's not a whole lot of confidence in, to be perfectly honest, right? And they're not doing a good job. So we have to uplevel that. We have to know which vendors actually do have good security, which are communicating well, which have the controls in place, which have locked down their products and services, which are treating your data with respect, and handling it in ethical ways, that takes work. And you may vet out certain vendors because they don't align with that. But if we don't ask the questions and we don't dive in a little bit more, we'll never know. And the vendors need that pressure, because if they don't have the pressure, why would they invest more in security? Why would they even try and pursue some type of certification or oversight or audits, right? It— that pressure has to come from the customers, and this is that first step. So what are we talking about here? Well, we need to formalize a vetting and approval process, and that's going to change and shift the cybersecurity policy guidelines and procedures. And that also has to tie in to the actual contract with these vendors and suppliers, because there's— there needs to be stipulation for both cooperation, and liability. Okay, number 3. Well, as a customer, we have to compartmentalize network access. And what are we talking about here? We're saying we need to limit access both at the perimeter and within the internal network itself. So there need to be more granular controls. Uh, something like Zero Trust architecture is really good, although there's no formal standard, but The architecture and the concept there is really good. There's lots of vendors out there. The process of whitelisting is also very good, only allowing certain connections with trusted parties. Authenticated point-to-point or end-to-end encryption, right? These kinds of things are best practices, and it limits, very much limits, who can come in, and once they are on the inside, where they can go. So even if you do have a trusted application or process or something of that sort, it's very limited where it can go. And that creates tremendous barriers for the attackers who can get a beachhead, but if they can't get any farther than that, right, that gets very frustrating, and that can force them to show their hand or move on to a different target. So that's very important. Again, not an easy thing to do. Okay, let's look at number 4. Talking about those contracts, we have to implement contracts that require better security, faster notification, cross-team cooperation like, uh, training or response exercises, and also have more specificity for liability coverage for response and, and even damage relief. But when we're creating those contracts or signing contracts with third-party vendors, suppliers, contractors, whatever. This needs to be part of the language, and the legal team needs to make sure that it's in there and it's aligned with the overall risk that the company is willing to accept. Okay, let's move on to number 5. Number 5 is really about cross-training between those third-party suppliers and vendors and their customers, right? We want to have cooperation to improve responses between those entities. You know, are you doing tabletop exercises? Many of the best companies are doing cyber tabletop exercises or some kind of drills at least once a year internally. But why aren't you also including your third-party vendors? Think about that. We're all tied together in this chain. And the supply chain. So we need to be working at that level as well. And when something goes sideways, you better hope that your CISO has a personal relationship with the CISO of that vendor or supplier, right? You want that informal trust and communication, and you want to know the crisis teams are going to be able to work in lockstep very quickly, jump on it fast, very effectively. So again, we have to expand those crisis exercises to include the customers, but also the suppliers and vendors. Okay, number 6, um, we have to test the vendor and supplier updates. Now think about this, when you install software, many times it's calling back to that home company and doing updates, whether it's your operating system or applications. Software that you've purchased, services, things in your cloud environment, right? We need to make sure where it makes sense that we are testing those as much as possible. And again, there is some difficulty there in understanding exactly what you should do. And in general, what I would recommend is delaying any non-security updates, like feature updates. Right? Or pre-deploy those into a test environment for a while. Take a look at them, vet them, see if they're doing what they should do or not. All right? And you just want to have a little bit of sanity check. And I've worked with organizations that would release to one part of the company that was less sensitive and would hold back for a period of time just to make sure it didn't crater their most important important part of their company. Again, whatever makes sense for, for the industry, for the organization, and everyone's going to be different. This is something that the CISO and the frontline managers, the C-suite, really kind of need to decide. What is that right balance between security, you know, risk management, cost, business impact, things of that sort? Okay, let's go to 7. This is an important one, and it often gets ignored. We have to remove legacy software, systems, and data. Think about this, right? Old data becomes caustic. Legacy systems that aren't used anymore, but are still out on servers or still have connections or accounts or still running, they are a growing vulnerability over time. Get rid of them. Now, often organizations, well, they spend money to integrate these things, but they don't want to spend the, the expense or capital or have the business disruption of ripping them out when they're no longer used. But again, they create a huge security risk, especially for those products that are no longer supported by the vendor, because the bad guys may find new vulnerabilities. They may never get patched, right? You may never patch them. The, the vendor may never actually create a patch form, and that constitutes an unknown vulnerability that can be exploited. So as part of any lifecycle for hardware appliances, software applications, services, whatever it is, there needs to be that at the very end, we're gonna end the life, that we're gonna remove it. Otherwise, it can be your Achilles heel. All right, let's talk about the supplier side now. This is about the vendors, third-party suppliers, so on and so forth, that are, you know, providing the software, the operating systems, the cloud services, whatever it is. First and foremost, the suppliers and service vendors must instill better security oversight for their products, development, and deployment environments. And this all makes sense, right? This is where the areas that are being attacked and targeted by attackers that want to compromise a supplier and then propagate out out to all their customers. So we have to make sure that those suppliers have a much better level of security, both to prevent, uh, compromises, but also to rapidly detect and be able to respond to those when they happen. So really, this is just an upscaling and an improving the cybersecurity capabilities of those suppliers. All right, number 9, We have to enhance downstream reporting. And what we're talking about here is those suppliers and vendors need to be able to report issues more timely. And that includes vulnerabilities, that includes exploits, and also fixes. Um, you know, a lot of times we'll see vendors come out and they have to report on a certain date and they're pushing the outside edge of, of what they have to do. Really, we want to start pulling that in. Why? Because the bad guys are getting better, they're getting faster, so we also need to get better and faster when it comes to communicating these issues, these risks, to the customer base and actively working with them. Alright, number 10, and this is a big one. This is huge, and this is probably the toughest out of all of them. On the supplier and the vendor side, there needs to be more transparency with the customers in regards to your cybersecurity status, your posture, your risk acceptance. And so part of that is understanding in-house security controls. And we're actually seeing some companies tie those controls, those metrics dashboards and provide those dashboards to their customers so their customers can see in real time what controls are in place and how they're performing against those. Radical, radical. Normally that type of information is never shared outside of an organization, but we're seeing some forward-thinking companies actually move in that direction. I'm very happy about that. It brings its own risks, but those risks are, are dwarfed by the benefits. The more important area though, and the more challenging one, is for companies that provide these software and appliances and everything else that you're gonna bring in and put on your network, or you're gonna connect to, they need to start documenting product behaviors. And this will enable users, right, those customers, to better secure them through compartmentalization or proper monitoring or alerts. So what this would really mean is if I'm a software vendor, I should be telling my customers what to expect. Hey, this particular piece of software, here are the type of connections it makes. This is the type of traffic that you should expect across your network. And it needs to be explicit, explicit enough for customers to whitelist something in ACLs or set alarms for anomalous behaviors. Right? To the extent of saying, hey, my software does a heartbeat connection about 4 times an hour against this IP range or DNS name with this type of data that is less than 50K and will never exceed more than 100K. Now, at that level of detail, that allows a customer to not only put in controls to say, I'm gonna whitelist, right? Or I'm gonna specify this unique connection and nothing else for this software. And I'm gonna look for data streams that are greater than 100K in case somebody's trying to exfiltrate something out, you know, big files, that's gonna flag, right? And it gives them the ability to lock things down, to detect when something's going wrong. And when they do, they should be communicating that back to the vendor to say, hey, I'm seeing your product doing something. What do you know? Are your other customers seeing this? Is this a breach? And now you guys can work together to figure out, is this just anomalous behavior and benign, or is this potentially malicious and you need to move fast on it? So it helps everybody in doing that, but that type of documentation about products and services is not easy. It is time-consuming, and a lot of software and hardware organizations think that that exposes them too much. And again, I'll go back to the fact that yes, it brings a little bit more risk, but that is completely dwarfed by the massive benefits that it provides both the vendor and the customers. So this is really where we need to go. All right. SolarWinds attack, it, it, it really has been a wake-up call for CISOs and business leaders, and it's been prompting them to review their supply chains chain dependencies and to identify their greatest vulnerabilities. It seems that every conference that I'm going to and speaking at, that is a huge topic. When I'm talking to my peers in the back room and we're talking about what's going on in this industry and what we have to solve, this is topic number one right now because we are so far behind. The industry is really scrambling to figure out how to fundamentally change and improve overall trust when we're talking about third-party vendors and supply chain security. And it will take everybody to find those, that right combination of solutions and best practices. There is no simple solution or tool. So first off, don't believe any vendor peddling wares saying that they can do and solve this problem and ignore them. They're lying. They're not trustworthy, don't do business with them, right? The entire digital supply chain, you know, chain was never designed with this threat in mind. So expect it to take some time for the security industry and the customers and everybody else to make significant strides to undermine the likelihood of such attacks. And again, the primary attackers in this field are nation states. Some of these nation-states have billions of dollars to throw at this area to try and keep it vulnerable. So this is going to be a big test for cybersecurity in the next few years. But in the meantime, these 10 practices that I just talked about can greatly reduce the risk of compromise and the overall cost of impacts. For every organization out there, vendors, suppliers, and customers. I suggest to apply what you can. Now, let me know if I've missed anything. Let me know in the comments. And as always, click on the like button if you found this insightful and subscribe to the Cybersecurity Insights channel for more best practices, rants, and strategic viewpoints.