Supply chain cyber security podcast

Don’t be the weakest link; a deep dive into supply chain security

Head of Cyber Security practice at Evalian, Matt Gerry, and Evalian’s MD Sean Huggett, discuss some key areas around supply chain cyber security. This podcast episode addresses questions such as, what is supply chain security, the risks associated, the questions you should be asking your supply chain and some steps you should be taking to mitigate these third-party supplier cyber risks, ultimately bolstering your security posture. To learn more, read our extensive Guide to Supply Chain Security. 

Podcast transcript:

Sean: Every organisation has a supply chain upon which they rely either for the provision of their services or, in order to provide services to their organisation, to help them meet their core business needs.

It’s increasingly the case I think that whereas supply chain security – as one of our colleagues once said; was “the elephant outside the room”, it’s something more of an “elephant inside the room now” and organisations are struggling to make sense of what does it mean, how they can implement it.

What do we mean by supply chain cyber security? and what steps should organisations take to implement a supply chain or supply chain security risk management programme?

Matt: Organisations are processing a vast amount of data and a lot of that is leaving your organisational boundary.

Sean: Why is it leaving your organisation?

Matt: Well because you have a complex supply chain in which you rely on, a lot of suppliers to deliver services for you.

One example would be your cloud service provider, most people now use some form of cloud infrastructure and that’s now part of your supply chain, because maybe 20 years ago you’d have bought the software, you’d installed it but now someone’s providing it to you as a service.

So, why would you want a business to spend lots of money on stuff that isn’t your core service, and isn’t making you money when you could outsource that expertise to an organisation that has the infrastructure to handle that every day? It makes total sense to move something from a capital expenditure to an operating expenditure and farm it out.

That’s a simple example. We’ve all got SaaS Services and we need to think about the security within that software-as-a-service, but what if we’re outsourcing, say we’re in hospitality and we outsource ticketing or we outsource the delivery of some key aspect of our business, is that part of my supply chain? If you were relying on a third party to deliver a service or to deliver the service that you are providing to your customers or your clients, what way is that a risk to my organisation from a cyber security perspective?

Sean: I’ve got my organisation and I can put a wall around it and I can have roots in and out and I can provide the information that they need to them, but why is it a risk to my organisation if I’ve outsourced elements of my business to them from an outside perspective?

Matt: It all stems down from the business’ purpose – your business exists to deliver a product or deliver a service if you can no longer deliver that product or service because someone in your supply chain fails then that’s a significant risk. It’s a cyber security risk because your organisation will have cyber security risks in the same way that your supplier has cyber security risks.

Sean: But that’s an interesting point though, so if that business fails and it’s a term that we use a lot in the industry – this is about size and business resilience or even as DORA would say, operational resilience because if they can’t provide their service you might not be able to provide your service, there might be something missing… Absolutely. But also I guess if they suffer a breach, the data they hold or the access they’ve got might be our data?

Matt: In order for them to facilitate their services, they might need to collect your data, you might need to send them your data, that data may include information, personal information about your customers, and your clients. You’re very likely sending out very high-risk data from a regulatory perspective under GDPR to one or more members of your supply chain or sub-processers.

Sean: All right, so thinking about the GDPR then, back in 2018 when we were thinking about, who are our data processors and what do they do? How have they secured our data? Lots of data processing agreements going out, and lots of conversations around what level of security you apply to personal data. So data security is one part of it, not just personal data, what about those suppliers though that are integrated with our systems or even have access to our system where’s the risk there, what’s the concern?

Matt: The risk there is that they’ve got access to your system, in the same way you would want to control access to your systems internally, you want to make sure that that supplier is accessing your system securely. So the risk is that if the user is compromised, they aren’t practising good security hygiene, then the knock-on effect is that those credentials that access your environment are compromised and then your environment is compromised.

An organisation could be very confident in their own security controls and maybe that’s correct but then the attacker will see that and think “Okay what are alternative ways into your system?” and one of those ways might be through your supply chain.

Sean: What is it that’s making organisations think they need to do something about supply chain security or third-party risk management?

Matt: I mean there are a few things. One is looking at other organisations in their sector that get hit by an attack that comes through their supply chain. Another is through regulatory pressure so you have NIS 1 back in 2018, obviously, GDPR puts pressure on identifying where your personal data sat within your processor, and sub-processors.

NIS 1, going back, put emphasis on securing the supply chain of operations Central Services. NIS 2 has recently come out which expanded the scope of NIS 1, so more organisations are being brought into that sort of regulatory pressure and then you have other regulations coming around DORA.

Sean: Do you think that there’s pressure also from other interested parties like insurers?

Matt: Absolutely, you know it’s not just regulatory pressure, insurers are increasingly looking at the supply chain as a significant cyber security risk.

So if you want to get cyber Insurance, having a robust security supply chain risk management process or framework in place is a requirement for most insurers.

Sean: Now it’s interesting that isn’t it because we’re working with a client at the moment who is bidding for a large contract with a public sector government organisation and they’re looking to flow down a substantial number of security conditions and actually one of the things that came up was they also wanted a major indemnity and unlimited liability indemnity didn’t they?

Matt: So there’s pressure from all sides effectively. You’ve got pressure from your potential clients to validate your cyber security controls, those clients increasingly want their requirements pushed through your supply chain, so you will be talking to your suppliers about their supply chain security or their internal security and then they in turn should be talking to their suppliers etc.

So as you can see more and more organisations are being brought into that pressure.

Sean: What’s the current state of supply chain risk management in your experience? Where are we at as an industry around knowing our suppliers and understanding security risks within the supply chain?

Matt: I think it’s probably still in its infancy with most organisations, it’s a difficult thing to get right. It’s implementing a technical control or getting a new SOC or a solution in place that’s more tangible, looking at the complexities of trying to establish a relationship with the suppliers and then defining what security requirements you’d want to flow down through. It’s a complex process.

Sean: What are some of the barriers? It’s hard, it’s complex you’ve said, but what are some of the reasons why organisations may struggle with it?

Matt: Plenty, similarly to a lot of security issues within organisations, it comes down to time and resources of the teams involved with this; most organisations need to be slim, the people, where supply chain security sits, tend to be smaller teams, they might not have the time or the expertise to put in place an appropriate level of security. There’s also the cost, so there are various aspects.

Sean: What you’re saying then the same challenge is that any security function if there is a dedicated security function within an organisation, the first thing is maybe expertise?

Exactly. Even if they’ve got expertise they might be short of time and resources and I assume it’s much wider than just a security problem. I’m assuming that when we’re talking supply chain, there’s other functions within the business that suffer?

Matt: Absolutely, so not only is it complex, what I was trying to allude to earlier around time and resources and implementing controls from almost an IT perspective, that’s relatively easy because you control that domain within the business or the person who tends to be responsible for security cyber security will have more impact on that area of the business.

To get supply security right you need to engage with the likes of procurement, the likes of legal, and the likes of compliance.

Sean: One of the questions that we might get asked then is “Does it really matter if an organisation has not suffered a supply chain security incident? Why would they suddenly need to start thinking about risk? Do we have examples of real-world breaches or outages that have occurred as a result of a security failure in the supply chain?

Matt: It can be very difficult if something hasn’t happened to an organisation to get buy-in and be convinced that actually this is a priority and should be looked at because there are lots of other conflicting priorities, and that’s understandable.

I think a very good way of putting this into context is to look at real-world examples. A great example is Crowdstrike to answer that one, there was a fail-over process which impacted one of their suppliers Microsoft, which then impacted a massive range of organisations around the world and caused, and they’re probably still counting the damage, and probably for a lot of those organisations that was the first time they’ve had an incident.

Sean: But that wasn’t a security breach that they themselves suffered?

Matt: It was a failure of controls within Crowdstrike which led to an availability outage which then impacted, because of the ubiquity of certain organisations in loads of organisations’ supply chain, had that knock-on effect on organisations who were clients of airports, hospitals etc. etc.

Sean: What about examples though where someone’s supply chain has actively been the subject of a targeted attack?

Matt: The SolarWinds cyber attack springs to mind. I believe that was a good example of a state-sponsored group compromising a piece of software that was used by a broad range of clients.

Kaseya is another good example, so they had an attack on their infrastructure, a Ransomware attack, and knock-on effect that impacted around 50 MSPs and another 50 probably 500-600 more of their clients.

Sean: I suppose the thing that’s interesting about SolarWinds and Kaseya is that the threat actor was targeting them but they weren’t then subsequently trying to get access to one of the organisation’s suppliers, they were able to pivot into multiple organisations?

Matt: Exactly and it comes back to that if you look at your supply chain you’ll find names that not only you’re using, but the organisation next to you is using, the one next to you and so on.

Some of these organisations Microsoft, Google etc. are ubiquitous across most organisation’s supply chains so if you think of an attack that successfully compromised one of those, I mean you’re looking at a massive knock-on effect.

Steps to effective supply chain security

Sean: Okay, so we know what supply chain security risk management is and means. We also understand now why it’s increasingly important to organisations. We recognise that organisations are starting to talk about it but might not understand how to handle it, so if we were working with a client what would we be recommending to them, what’s the starting point for implementing a supply chain security risk management program?

Step 1:

Matt: What I say to any organisation is; understand what is there that you can’t protect what you don’t know, so figure out who are your suppliers.

It’s actually quite complicated, I don’t think I’ve ever walked into an organisation where I’ve had a straight answer to “who are your suppliers?” and you know that’s completely understandable because businesses have different arms, they have different functions, and each function may have their own suppliers delivering a particular service.

If you think about your finance team, they may have their finance software which has no bearing on the procurement function, or the marketing team will have their Adobe subscriptions and things like that. So when you look at an organisation, especially complex organisations and the ones we work with, that’s not an easy answer.

Okay so step one, identify your suppliers, then what?

Step 2:

Matt: Then figure out what they do for you, you know good a example is when an organisation we work with in power generation, you might have one supplier but they may be delivering a discard system but they also might be manufacturing wind turbines or they might be delivering sensors to go into a boiler. That’s one supplier, but within that supplier they’ll have different arms and they’ll have different risks.

Okay so some parts might be providing you with products, other parts might be providing you with services, other parts might be doing both, or it could be an a SaaS platform or it could be infrastructure.

I know who my suppliers are, and I know what they do for me, where do I go from there?

Step 3:

Matt: Then you need to understand how critical is what they do for me. Fundamentally you want to understand which suppliers I rely on to deliver my core businesses. If I want to achieve my objectives as a business, if I want to sell more products, deliver product, get great customer feedback, grow my customer base, and grow my client base which of my suppliers are most critical.

Sean: So I know who they are, I know what they do I’m going to categorise them by importance? So how do I do that? Is it about impact?

Step 4: 

Matt: So a good place to start is impact. If they suffer a breach or they can’t provide their service to me? Yeah so you want to factor in a number of things here. You want to understand right okay if they fall over and the availability of their service ceases to exist for me, can I continue to deliver my services or can I fail over to another supplier?

Sean: So that’s them affecting my business, my operations?

Matt: Exactly and the other flip side to that is to identify what they do for you – do they process your data? It could be personal data, could be special category data or it could just be very sensitive business data that’s embarrassing.

Or do they have direct access to your systems? And by that I mean, if they were compromised would it be possible for that attacker to then gain access to my information which would be damaging to me personally? Or gain access to my environment, which is also a massive risk for me.

Sean: So I know who my suppliers are, I know what they do for me and I’ve identified, I’ve categorised them based on their importance or impact so I know not all suppliers are equal what do I do now?

Step 5:

Matt: So this is where it gets a bit more complicated, not to say that the first phase was easy. But the next step is what do you do with that information? You know the ones that are most critical to you.

I think there are probably a couple of phases to this where one; you’d want to define what are your security requirements for suppliers, and what do you want your suppliers to achieve. Because you talk to them, say “you need to be better at security” they’ll say “right give us a give us a benchmark, tell us what you want us to do”.

Then there’s considering how you communicate that to your suppliers. So obviously the best time to do this is during contract renewal or at the initial stages. During the procurement process it becomes more complicated with established suppliers, you might want to think about signing up for a code of conduct, something like that a little bit more wishy-washy, but still sort of gets across your intention.

Step 6:

Matt: So once you’ve established your requirements, you can then start monitoring your suppliers. The other side to that is you want to understand what they’re doing in a general sense. This will depend on the criticality because there are not infinite resources out there. You would want to understand what are the security governance processes that your supplier has put in place, how are they managing their own information security. So you need to engage with them, you need to start that dialogue.

So let me break that down then so we know who they are we know what they do we’ve tiered them based on their importance, from that point then we’re going to communicate the security requirements that we’ve got for them? I suppose based on the categorisation there might be more significant requirements for important suppliers? But for maybe less important suppliers we might apply a lower level (of supply chain security) we might say you need to be Cyber Essentials Plus or equivalent?

Exactly.

Sean: How do we understand what our supplier’s current security posture looks like – what’s the most common way to find out?

Matt: Well so there are a couple of avenues. The most common one, and probably the most dreaded and the most complained about, is your security questionnaire.

That will come back to you and you’ll look at that and go “right well that’s given us comfort”. Or “we’re not too comfortable with that give us more information, you’ve said you’ve certified to this standard” say ISO 2701 or Cyber Essentials or something like that – “show us the certificate”.

So organisations – and we’ve been on both sides of this with different clients those that have received questionnaires and those that have sent questionnaires out – they send a questionnaire out they get 10-15-20 responses back, they’ve then got to make sense of those. They’ve got to work through them and translate that into risk that they can then make plans around in terms of how they respond and manage it.

Sean: So how do organisations address that challenge?

Matt: It’s difficult, organisations don’t have a limited budget and their internal teams don’t have unlimited time and this takes time to engage with the suppliers to discuss and to really analyse the risk.

One option is to outsource that to a specialist cyber security organisation that can provide that gap between “right okay we know we’ve got a supply chain risk, we need to understand what that is, we need help translating it into a format that we can understand and then manage going forward”.

Sean: So that’s a nice opportunity for us to talk about Supply IQ which is part of our supply chain service service.

Matt: We developed a web application called Supply IQ which we anticipated would be used by organisations as a third-party risk management tool.

We’re not a software-as-a-service company, we are actually a consultancy business and in developing it we came to realise it was less about the tool because we work with lots of organisations that had tools, things like One Trust, Risk Ledger, and they’re really good tools, but they probably didn’t have the expertise to make sense of the responses to then work out how to respond to them and think about how they would manage the risk associated with that.

We developed it as a service. So how does our service work and if a client was working with us, how would that process work, how would we map onto their organisation to provide that service to implement their program and manage their supply chain risk?

Matt: It’s a great question, and this goes back to why we discovered it was less about a tool and more about that service that sits behind it. Organisations were coming to us and saying “we don’t just need a tool, we’ve got tools, what we don’t have is time or the expertise to implement and then manage this and then analyse it and translate it effectively.”

So the expertise is around interpreting the feedback. An organisation comes to us and they tell us that they don’t have MFA on external interfaces or they don’t do any security training, or the customer environment doesn’t have penetration testing and we then interpret that in the context of the service they’re providing.

Absolutely, organisations that use our service have access to subject matter experts in cyber security and cyber security is a broad house, so there is a deep bench both technically and from a governance and process perspective.

Our cyber security expertise allows us to look at organisations within the context of the service they provide but also within the context of what good cyber security practices are, and that will tease out information – things that might not necessarily be immediately obvious, especially if you’re having to go through 20-30-40 of these things.

A good example would be if an organisation says “Well of course we’ve got MFA, the only way you can access this critical environment within our infrastructure is from a trusted network”. But then it turns out that they’ve got VPN on that network, that doesn’t require MFA, so looking at those in silo – “okay that’s a bit of an issue but that’s great”.

Well actually that VPN allows access to a trusted Network, and devices on that trusted Network might have access to the infrastructure but no MFA at the very front of that, how can we rely on that trusted network?”.

That’s where the expertise comes in, whether it’s in a client’s organisation already and they’ve got a tool like One Trust or whether it’s using our SupplyIQ service, it’s building the context out of the tool, it’s being able to interpret it.

So it’s information versus analysis.

So whether it’s a SupplyIQ service or whether an organisation is doing it themselves, I think what we’re saying there is it’s important to analyse the feedback that comes back and then think about it in the context of the services that they provide. A “no”, or a negative response from one supplier might present a relatively insignificant risk, but from another supplier, it might be a really significant risk? Absolutely.

Sean: So having gathered the information and understood the basis or the baseline security that suppliers have got, how does the service then provide value back to the client?

Matt: Once that information has been analysed and we’ve got to the point where we think we’ve built up what is an accurate picture of your supplier security practices, we will translate that into actionable recommendations, because throughout this process we’ve built an understanding of what your risk appetite is. But also how the lack of technical control or lack of process may have a specific impact on your business, the data or your people, and that’s the key thing with it being not just a tool but a service.

The feedback is consultant-driven based on an understanding of your business. So at the end of a cycle the service may have identified areas of risk but we’re not just saying “Here you go, up to you what you do with them now”.

We’re actually giving them guidance and advice on their options and what other areas of good practice might say is the right approach to take depending on their risk appetite. What’s good practice, what’s reasonable and what do we think you, as an organisation based on what you want to achieve, should aim for.

What does the future looks like for supply chain security risk management?

Matt: Honestly I think organisations are going to be worrying more and more about their supply chain security.

What we’re seeing over the last few years and going forward every organisation is part of some form of supply chain. Through regulatory pressure, insurance pressure or other pressure, cyber security requirements are being pushed down the supply chain.

Part of that will be adopting good cyber security, not only good internal cyber security practices but also looking further down your supply chain to understand where risks are and mitigating those risks.

Do you need support understanding your supply chain security risk?

We can help. With the increasing interconnection of organisations, managing third-party suppliers is becoming a complex issue as you can see from this discussion, opening further avenues of risk. Limited resources and the availability of sufficient expertise around this subject are proving to be a key challenge.

If you need support and direction in managing your third-party supply chain,  call us for a no-obligation chat. 

We can provide bespoke solutions that can be tailored to your business to support the management of your supply chain security.