A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less-secure elements in the supply network. A supply chain attack can occur in any industry, from the financial sector, oil industry or government sector.

It is, also called a value-chain or third-party attack, occurs when someone infiltrates your system through an outside partner or provider with access to your systems and data. This has dramatically changes the attack surface of the typical enterprise in the past few years, with more suppliers and service providers touching sensitive data than ever before.

TYPES OF SUPPLY CHAIN ATTACKS

• Compromised software building tools or updated infrastructure
• Stolen code-sign certificates or signed malicious apps using the identity of dev company
• Compromised specialized code shipped into hardware or firmware components
• Pre-installed malware on devices (cameras, USB, phones, etc.)

STEPS TO SUPPLY CHAIN ATTACK

I think the first thing that people should consider is that the attackers will always try to find the easiest way in. So if they recognize that their attack target has a weak point, they will use it. And in some cases the weak point is the supply chain. So if they recognize that the supply chain is vulnerable or it is the most critical place in the system, then that will be the target of the attack first. And that is kind of like the first step. But the second step would be to find ways to actually gain the necessary access to the supply chain. And then the third step would be to start doing the actions on objective on the actual target of the attack. 

How To Prevent Supply Chain Attacks

• Deploy strong code integrity policies to allow only authorized apps to run.
• Use endpoint detection and response solutions that can automatically detect and remediate suspicious activities.

For software vendors and developers

• Maintain a highly secure build and update infrastructure.
  • Immediately apply security patches for OS and software.
  • Implement mandatory integrity controls to ensure only trusted tools run.
  • Require multi-factor authentication for admins.
• Build secure software updaters as part of the software development lifecycle.
  • Require SSL for update channels and implement certificate pinning.
  • Sign everything, including configuration files, scripts, XML files, and packages.
  • Check for digital signatures, and don’t let the software updater accept generic input and commands.
• Develop an incident response process for supply chain attacks.
  • Disclose supply chain incidents and notify customers with accurate and timely information.

Drop Your Comment below.