Building practices that promote equality in the healthcare sector has positive trickle-down effects on society at large
How healthcare firms are advancing the interlinked issues of gender parity, health equity, and the financial status of women....
Supply chain
Cyber security: how to fortify the software supply chainĀ
Increased IT integration between companies and suppliers has introduced new vulnerabilities. How can organizations prepare for the staggering rise in breaches through third-party vendors?Ā
āÆWhen Zellis, the UK payroll provider, disclosed a security breach in June, the issue extended beyond the company itself. The hackers also gained access to Zellisās customers ā including British Airways, Boots, and the BBC ā and stole personal data belonging to tens of thousands of their employees.Ā Ā
This external breach is not an isolated event by any means. According to cybersecurity group Sophos, approximately 20% of British organizations experienced data breaches by external attackers in 2022,āÆmaking it vital for companies to identify and assess potential risks within their software supply chain.Ā
Itās a growing challenge for organizations around the world, not just in the UK. In 2021, cyber security technology company CrowdStrike reported a staggering 430% increase in attacks through supply chains globally.Ā Ā
It comes amid a trend towards increased outsourcing and IT integration between companies and suppliers. This creates new opportunities for hackers to breach entire ecosystems with just one attack, creating a ādomino effectā which can ensnare more victims. Zellis, for one, counts among its clients nearly half of companies in the FTSE 100 stock market index.Ā Ā
By providing training on how to identify these attacks, employees can become more vigilant and less likely to fall for deceptive tactics such as phishing emails (which trick them into revealing sensitive information like login credentials, often by posing as trusted organizations).
This should serve as a warning for organizations of all kinds. Building cyber resilience should no longer be restricted to the confines of your own company; organizations ought to consider the security of their software vendors, too, through the following steps.Ā
Set tough security standards for new suppliersĀ Ā
The first step is for organizations to establish robust security requirements and standards for new software suppliers. All too often, security is an afterthought, but it should be part of the early conversation about any new business deal. This reduces the risk of engaging with suppliers that may pose significant cybersecurity risks, ultimately helping organizations to mitigate the potential of a breach through the software supplied by third-party vendors.Ā
Make employees a valuable line of defenseĀ Ā
One important question to ask suppliers is whether their employees go through cyber-security training, which is critical to protect against attacks on the supply chain. Most of these breaches occur as a consequence of human error. By providing training on how to identify these attacks, employees can become more vigilant and less likely to fall for deceptive tactics such as phishing emails (which trick them into revealing sensitive information like login credentials, often by posing as trusted organizations).Ā
The training needs to go beyond encouraging employees to use strong passwords that contain numerous characters, numbers, and symbols so theyāre harder to crack; staff should understand how hackers operate, too. If theyāre aware of the tactics, techniques, and tools employed, workers can recognize potential threats before itāsāÆtoo late. This will make them a valuable line of defense.Ā Ā
Business leaders: stay informedāÆĀ
The training should not be limited to lower levels of the workforce. Top executives should be improving their āthreat intelligenceā or gathering and analyzing data from various sources to better comprehend hackersā targets, motivations, and methods.Ā Ā
āAnother key question to ask suppliers is their approach to patches and upgrades, which are used to address known vulnerabilities in software.ā
Those data sources include strategic intelligence about long-term trends and the broader threat landscape, such as state-sponsored hackers, a growing menace. Companies can also monitor the dark web, a hidden corner of the internet where cyber gangs operate, sell stolen data, and exchange malicious tools and services. This will help leaders stay informed and detect risks early. āÆĀ
Promptly apply patches and upgradesĀ Ā
Another key question to ask suppliers is their approach to patches and upgrades, which are used to address known vulnerabilities in software. Hackers search for weaknesses or flaws that can be exploited. Patches and upgrades are designed to close these security gaps, but all too often companies do not prioritize security upgrades, as they become complacent. Applying these promptly helps minimize the window of opportunity for attackers.Ā
Deploy technology for threat detectionĀ Ā
Beyond that, companies can use technology to monitor their software supply chain for potential vulnerabilities or threats, such as systems that continuously monitor and protect organizationsā custom and third-party software assets.āÆĀ
Many companies already use threat detection systems but they can be highly sensitive, sending alerts for false positives. A report from cybersecurity company Critical Start found that 70% of security analysts are investigating more than 10 alerts each day, with a false-positive rate of 50% or higher. Itās up to organizations, however, to take them seriously and conduct further investigations.Ā Ā
While deploying such technology and establishing a culture of collaboration with software suppliers are two strategies to help organizations proactively identify and prevent potential security incidents, they’re unlikely to stop every attack. Organizations, therefore, need to always be prepared for a breach they hope never occurs.āÆĀ
Adopt a zero-trust security modelĀ Ā Ā
One way to limit the potential impact of security breaches is to deploy āzero trust architectureā. So rather than presuming the safety of everything within the corporate firewall, the zero-trust model treats each request to access the network as a breach that requires authentication and authorization. It also segments the network into smaller zones to minimize the potential for lateral movement by hackers in case a breach does occur.Ā Ā
Cybersecurity is not the sole responsibility of IT professionals; it requires involvement from numerous departments including legal, public affairs, and operations.
There are other steps that companies can take to limit the damage from a cyber-attack and restore normal operations. They include working out the nature and extent of the breach and then isolating affected systems to limit the spread of the attack while preserving evidence for forensic analysis.Ā
Involve cybersecurity expertsĀ Ā
Itās also important to involve cybersecurity experts, who possess the necessary expertise and experience to assess the impact, identify weak spots, and deploy countermeasures. But the entire executive committee must be involved in the process. Cybersecurity is not the sole responsibility of IT professionals; it requires involvement from numerous departments including legal, public affairs, and operations.Ā Ā
Come clean to stakeholdersĀ Ā
Lastly, itās important for companies to come clean and keep their stakeholdersāÆāāÆemployees, customers, partners, regulatorsāÆāāÆinformed about the breach. The aim should be to ensure transparency while protecting sensitive information. With the number of cyber incidents rising, the potential reputational damage that comes from poorly managing an attack is significantly higher than actually being breached.Ā
Given the continuous increase in IT integration between companies and suppliers, itās become imperative to establish robust security protocols along the software supply chain. Though due diligence, training and development, patches and upgrades, technology and monitoring, and zero trust architecture are useful tools in the fight against hackers, the fight for our supply chains is far from won.Ā
Ā
Authors
Related
South Korea needs to transform its talent and its organizations to continue to grow
South Korea possesses formidable R&D and digital prowess yet fails to fully capitalize on it due to talent shortages and organizational inefficiencies. ...
Halfway to 2030: Are our Sustainable Development Goals still fit for purpose?
While the rosy optimism that greeted the UN Sustainable Development Goals when they were first launched in 2015 may have faded, I have tracked some cross-sector and private-sector progress thatās really making...
How reverse positioning can provide a useful change of perspective
Reverse positioning can help businesses understand how they are pigeonholed by customers ā and reveal opportunities to improve their standing versus the competition. ...
Learn Brain Circuits
Join us for daily exercises focusing on issues from team building to developing an actionable sustainability plan to personal development. Go on - they only take five minutes.
Ā
Explore Leadership
What makes a great leader? Do you need charisma? How do you inspire your team? Our experts offer actionable insights through first-person narratives, behind-the-scenes interviews and The Help Desk.
Ā
Join Membership
Log in here to join in the conversation with the I by IMD community. Your subscription grants you access to the quarterly magazine plus daily articles, videos, podcasts and learning exercises.
Ā