It seems like every other day our computers are sending a notification that one thing or another needs to update. These interruptions have always been mildly annoying, but now they have a sinister undertone to them. 

In the latest supply chain attacks that have been hitting the US, update mechanisms have been hacked at the source, with ransomware delivered to users via the system itself. Does this mean you can’t even trust the operating system you work on? Read on to find out.  

1. Having IT support isn’t enough

While business IT support is essential for enterprises of all sizes, supply chain attacks are often able to bypass your usual security measures because they don’t attack you directly. Instead, they target a third-party vendor you use, infiltrating their system and then reaching you via legitimate channels. For this reason, cybersecurity alone is not an adequate safeguard against supply chain attacks. 

2. Old-fashioned communication can help

The rise of this new threat type means that we need to return to a more old-fashioned way of doing things. It’s important to build a relationship with every third-party vendor with whom you work. You need to know who they’re connected to, what their security is like, and what processes they have in place should a cyber attack occur. 

3. Planning for the worst is crucial

Though you may think your business wouldn’t be a tantalizing target for attackers, many hackers are simply out to make a quick buck wherever they can get it. Many crime syndicates aim to reach as many businesses as they can through their Virtual System Administrator (VSA) or ​​Multiple Managed Server (MSP). The more businesses they can hit with ransomware, the higher their returns are likely to be. You could simply get caught up in their dragnet. 

For this reason, it’s important to plan ahead now while the proverbial sun is shining. Conduct risk assessments and threat hunts to see if you have already been targeted by malware and to assess whether you have any weaknesses or missing links in your detection system. 

4. All businesses should have a strategy in place

Once you’ve assessed the current situation within your business and your supply chain, it’s important to create a strategy going forward. This will involve you and all the vendors in your supply chain. 

This is the key with supply chain attacks – it doesn’t matter how bulletproof your security is, if one of your vendors has a weakness, it can be exploited, and you will be just as much at risk as if you had no strategy in place. So, develop a plan and make sure it can be seamlessly integrated with the strategies employed by your vendors. 

5. Staff need to be in the loop too

It can be easy to assume that only IT staff and top-level management need to be involved in strategizing about supply chain attacks. However, staff can be a vector too, so it’s important for everyone in your organization to understand the threats, how they can find their way in, and what protective measures can be taken. 

Hackers may exploit a weakness in a website frequented by your employees (known as a watering hole attack) or they may even target the website builder used by your in-house team or web design agency. So, it’s essential that all staff, including contractors and freelancers, are briefed on the risks. 

Supply chain attacks always come via a trusted source, making them one of the most alarming forms of cybercrime. As with many things in life, education and communication are your best defensive weapons.