5 Steps To Supply Chain Security

The integrity of enterprise data is only as strong as your most vulnerable third-party supplier or business partner. Its time to shore up these connection points.

Download the entire
August 2014 issue of
Dark Reading Tech Digest
, distributed in an all-digital format (registration required).
One of the largest known breaches, resulting in 110 million records lost and hundreds of millions of dollars in damages, started with a small, third-party supplier. Were talking about Target, where attackers compromised Fazio Mechanical Services, a provider of heating, ventilation, and air conditioning services, to gain access to the retail giants network. The breach lasted 19 days and contributed to a 46% drop in year-over-year quarterly profits for the company, according to Targets filings with the Securities and Exchange Commission. Nearly 100 lawsuits have been filed so far, and Targets then CEO, Gregg Steinhafel, and its CIO, Beth Jacobs, have resigned.
The Target breach is a watershed moment in third-party attacks, says Stephen Boyer, CEO of BitSight, a security intelligence firm. No one wants to be the next one.
The breach may be a watershed, but its hardly unique. The August 2013 defacement of The New York Times occurred because attackers fooled the media organizations DNS provider into granting access to the account that determined how the Internet routed traffic to the Times site. Lockheed Martin suffered an attack through a flaw in RSAs SecurID system. The email addresses of customers who sought support from Twitter, Pinterest, and Tumblr were leaked when attackers breached support services firm Zendesk in February 2013. Security and CDN service CloudFlare was infiltrated via its CEOs Gmail account.
And the beat goes on.
Piggybacking on third-party suppliers is now a well-worn page in attackers playbooks. Both RSA and whitelisting provider Bit9 suffered compromises, not to steal their data, but to weaken the protections around companies that use their services. IT is aware of the threat; respondents to InformationWeeks
2014 Strategic Security Survey
who feel more vulnerable to attack this year than last increasingly point to partners. Those citing an inability to audit or assess outsourcing and/or cloud vendors jumped by nine points year over year, with fears over vulnerability of key technology products shooting up 13 points.
If I want to attack Fort Knox and I know they have locks and guards and strong security, it is easier to attack one of their providers who already have access to the gold, says James Christiansen, VP of information risk management for Accuvant, an information security service provider.
Adding insult to injury, companies breached via a third party generally find their recovery costs higher. In 2013, the average breach cost for a US firm was $201 per lost record, according to the Ponemon Institutes
2014 Cost of Data Breach Study: Global Analysis
report. Third-party involvement was the second most important negative factor in the cost of a breach, costing companies an average of $14.80 more per record, just behind the impact of a lost or stolen device, which added $16.10 per record.
Vendors, Suppliers, Contractors -- Oh, My!
US companies rely heavily on third-party firms to provide services critical to their businesses yet generally have little visibility into the security practices of those firms. While larger suppliers may spend a significant amount on security, there is no guarantee -- and less likelihood -- that smaller partners are making similar investments, says BitSights Boyer.
In short, supplier-based attacks are particularly scary because theyre out of ITs control. The only real knob or lever you have is the questionnaire, says Boyer, referring to the annual surveys many companies use to assess their suppliers security and, in theory, prod providers into taking protections more seriously. Some supplier-customer pairs are more likely to be targeted, such as retailers reliant on third-party point-of-sale technology firms, companies attacked via their law firms, and medical information targeted through the doctors office. But no one is immune.
To read the rest of this story, download the August
Dark Reading Tech Digest
, distributed in an all-digital format (registration required).

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
5 Steps To Supply Chain Security