Your vendors like Accenture and IBM have direct access to your live systems, and attackers know it. Malicious code can slip through the software pipeline into production without proper testing or approval. Tier your suppliers by risk and enforce multi-factor authentication to lock down the weakest links.
You'd be surprised the access that some third parties have to your live systems. The most common weakness, if you look at what has been publicized of cybersecurity, I see is misplaced trust in third parties and also in the software delivery pipeline. So when I talk about third parties, you've got your large players like Accenture, IBM, but there'll be companies working with much smaller businesses, IT vendors who are helping them with code changes on their enterprise systems. And then, when I talk about software delivery pipeline, that's, you've got a project or even a small change happening where someone's changing something in the system. They'll put that in a test environment, and then they'll put it through into production, and you can use that in your day-to-day. So attackers are abusing those trusted vendor access and also tampering with the build and update processes to slip past perimeter defenses. So what I'd say to prioritize for leaders is strengthen your third-party risk management. So that means enforcing cybersecurity standards for suppliers. You need to make sure that you're tiering your suppliers. So who are the most critical to your supply chain? Make sure you've got minimum controls. So think about multiple multi-factor authentication. You'd be surprised the access that some third parties have to your live systems. I've seen changes happen to code without proper testing and without written authorization. And that's not even an external attack that's happening. That's just somebody's bypassing— there's no process in place.
