Today, I was with some manufacturing businesses who have recently experienced a significant increase in cyber activities, largely through their diverse supply chains. They had initially attempted to manage this themselves, but when the risks elevated, they sought external expertise. The principles of supply chain cybersecurity are definitely better understood in 2023, but the landscape is changing so rapidly it can be difficult to prioritise. So, what the most effective response for Supply Chain Cyber Risk Reduction?
Recommendations for Supply Chain Cyber Risk Reduction
My first recommendation is the excellent guidance provided by the NCSC embedded in these 12 principles. The NCSC divides the approach into 4 easy to implement stages of:
- Understanding the risk
- Establishing control
- Checking your arrangements
- Continuous improvement
We have worked with a lot of manufacturing and distribution businesses in 2023, as there has been a marked increase in nefarious activities in this sector. Our specialist partner, Dragos, recently completed their updated research that confirmed a 18% increase from the previous quarter in attacks. It is complicated by a number of factors, not least many of the affiliates are working closely together and providing aggregated intelligence and resources. Bottomline, cyber and supply chain risks are increasing. Significantly.
Understanding supply chain risk
The NCSC guidance starts with understanding risk, which focuses on:
- Understanding what needs to be protected
- Know your supplier security
- Quantify the security risk posed by your supply chain
The most significant issue with this for many organisations is helping supply chain businesses understand and assess their own security maturity. There are useful approaches available like the NPSA questionnaire, but feedback has been one of poor or inconsistent responses as smaller business of 5 to 50 employees simply do not have time or skills to do this, particularly in the current climate. It is a fair challenge and something we are striving to improve. Without this, understanding the security risks posed by your supply chain can be very difficult. Or, if you take a no response/compliance view, you would rate some of your best suppliers as too high risk to work with. And that doesn’t work for anybody.
How to gain more control over your supply chain cyber risk
The NCSC guidance provides very clear insights into how you should seek to establish more control of your supply chain. This includes but is not limited to:
- Communicating your view of security needs of your suppliers
- Setting minimum security requirements of suppliers
- Building security considerations into your contracting processes
So, by actually doing the first 6 principles together, setting realistic timelines to achieve this e.g. over the next 6 to 12 months, you will be able to reduce risks for both your business and your supplier. It is demonstrating how this can be achieved with minimal impact to all concerned that is most important up front to maximise engagement.
What I’ve tried to do about supply chain risk
Over 12 months ago, Jav and myself met with 2 manufacturing businesses leaders who expressed real concern at the absence of cyber industry solutions to the above problems. We responded by creating CloudGuard’s PROTECT Lite MXDR service. It is specifically designed for supply chain businesses of 5 to 50 employees, to help reduce key risks by embedding the above principles and enabling the NCSC principles I will discuss in my next blog on Supply Chain Cyber Risk Reduction.
What is MXDR? Read more
For more information on our PROTECT Lite MXDR service for supply chain partners, please reach out to [email protected] for more information or guidance. Together, we can reduce business risks from cyber disruption from today. Next week, I will talk about the second 6 principles in more detail. Thanks for reading.
