Matan Or-El (jan@eskenzipr.com) is co-founder and CEO of Panorays in New York City.
Cyberattacks in the supply chain are being industrialized to not only target one company, but many companies across a single industry. Cyberattacks hit two-thirds of firms, according toresearch by CrowdStrike,[1] and the impact reverberates from financial to operational disruption and the actual loss of customers.
Cybercriminals are now taking advantage daily of easy access provided by privileged accounts. Attackers target the weakest part of a supply chain, which means that even when an organization has top-notch security protocols in place, there’s no guarantee that these same standards are held by the vendors that already have access to the supply chain. Given this, it’s no surprise that about 80% of all cyberattacks happen in the supply chain, according to the SANS Institute as cited by KPMG in their report, “Digital Supply chain—the hype and the risks.”[2]
The sheer number of supply chain attacks proves that compliance and ethics officers must proceed with caution when it comes to auditing current vendors and vetting new ones. A multilayered approach must be implemented when working toward mitigating risk in the supply chain.
Perform an audit of every vendor
Whether or not a company has vendors that it’s been working with for years, an audit should still be performed for every supplier. The level of risk will depend on the nature of the relationship with the vendor; for example, a vendor with full access to a company’s IT system will carry more risk than a vendor without credentials. The audit should be thorough and dig deep enough to understand whether suppliers’ actions are aligned with the company’s security best practices and any legal policies. Even where there is an established relationship of trust and respect between supplier and client, this is a vital step in the process that could cause damage if overlooked.
