As companies are increasingly exposed to the risks of cyber attacks against their supply chains, it has become more important than ever to take protective measures.

Once their suppliers have more limited security actions in place, they become easy targets for cybercriminals to access their networks and promote attacks that can compromise the entire supply chain.

Cyber attacks against the supply chain represent a serious risk for companies of all sizes and segments, as they can lead to loss of sensitive data, theft of products, or even interruption of the flow of supplies.

In practice, managing the supply chain goes beyond keeping the purchasing, transportation, storage, and sales processes running smoothly. It is necessary to be aware of cyber risks in all links of the chain, from the supplier to the final consumer who has invested time and money in the purchase of a product or service and who seeks immediate satisfaction.

The purpose of our article is to show that there are measures that companies can take to protect themselves from cyber attacks, as a good portion still suffer from the challenge of securing their supply chain. Some recommended practices include implementing strong access control measures, data encryption, and regular data backup. However, these measures are not foolproof and companies must be prepared to respond to attacks should they occur.

What are the risks of cyber attacks against the supply chain

The global shortage of chips caused by the Covid-19 crisis, used mainly in computers, automobiles and mobile devices, is not the only issue affecting supply chains around the world today. A new survey by the NCC Group illustrates that the number of cyber attacks has increased by more than half (51%) during the period July to December 2021.

The study, which surveyed 1,400 cybersecurity decision makers, showed that 36% of respondents said they are more responsible for preventing, detecting and resolving supply chain attacks than their suppliers. Just over half (53%) said their company and their suppliers are equally responsible for supply chain security.

With the number of supply chain disruptions growing, many of the respondents recognize that this is an issue in the near future. Third-party and supplier risk was listed by respondents as a major challenge in the next six to 12 months.

Consequences of an attack

The risks of supply chain cyber attacks are numerous and can have catastrophic consequences. A security breach goes beyond the theft of confidential data and the disruption of critical business operations, a successful cyberattack can even lead to physical damage to infrastructure.

One of the most emblematic examples of a supply chain cyber attack occurred in late 2020 to a leading U.S. network and systems management software development company.

The attack impacted nearly 18,000 customers in a security incident that took place over nine months throughout 2020 before it was detected. Among the companies impacted were technology giants, US government agencies, and other prominent global organizations.

But the risk of attacks remains and new cases have been reported in the press in recent months, showing that different types of companies can be targeted by cybercriminals, including segments such as e-commerce and software service providers.

Example of the Japanese automaker that has suspended production at 14 plants in Japan for at least a day in response to a "system failure" at one of its component suppliers.

In a brief statement released on February 28, the manufacturer confirmed the temporary shutdown, which led, according to auto industry experts, to a 5 percent drop in its monthly production or the loss of about 13,000 units.

Another high impact attack, recently disclosed, occurred with a logistics operator headquartered in Seattle, Washington. The interruption of its global systems as a result of a cyber attack caused most of its operating systems to be shut down, jeopardizing operations including those in Brazil.

How to protect your company?

There are several different types of attacks that can hit the supply chain. The most common include:

• Malware Attacks

These attacks involve infecting software or devices with malware that can allow attackers to gain access to sensitive data or systems.

• Phishing attacks

Attackers use phishing emails or other methods to trick individuals into revealing sensitive information or downloading malware.

• Man-in-the-middle attacks

In these attacks, attackers insert themselves into the communications between two parties to spy or intercept data.

• Denial of Service Attacks

These attacks overload systems with traffic or requests, making them unavailable to legitimate users.

In practice, there are several steps that companies can take to protect themselves against supply chain attacks, including:

Implementing strong security measures with support from trusted partners: Enterprises should ensure that their own security measures are adequate to make it difficult for attackers to compromise their systems. Actions such as encrypting sensitive data, implementing access controls, and managing vulnerabilities can help prevent attackers from gaining undue access to systems.

2. Conducting vendor background checks: Organizations should examine their suppliers carefully to avoid doing business with those who may be more vulnerable to attack. Regular security audits can help companies identify problems and ensure that suppliers are complying with best practices.

3. Keep systems up to date: Organizations should regularly update their software and devices to fix any security vulnerabilities that can be exploited by attackers.

4. Employee awareness to strengthen security: Employees should be trained on how to identify phishing emails and other signs of attack. They should also know what to do if they think they have been targeted. Communication and awareness of risks and correct conduct in the digital environment should permeate the organizational strategies of all companies, regardless of size or industry.

There are steps that companies can take to protect themselves, but most are not doing enough. If you want to keep your company protected against cyber attacks, make sure you are following best practices for security and data protection.

Enlist the help of cybersecurity partner companies to ensure that your company is on the right track by certifying that your security actions are adequate. Partnering with trusted vendors is also important to reduce the risk of supply chain attacks.