As If You Don’t Have Enough To Do — Now You Have to Secure Your Supply Chain?

If you’re like me, your workload requires more than 40 hours. Anyone for 50 hours? 60? 

That’s why it might startle you to know that in addition to keeping your tech operations secure, you’re also responsible for cybersecurity extending across your interconnected system of vendors, partners, software providers and service platforms. And their suppliers. And their suppliers. And so on. 

Those of us of a certain age remember the famous 1980s commercial for Fabergé Organics Shampoo that featured the line " ... and they told two friends, and they told two friends, and so on, and so on."

That’s what happens when attacks hit your suppliers — a domino effect that can hit you and cascade across hundreds or thousands of downstream organizations.

And that’s why the supply chain has become one of the most important attack surfaces for you to manage.

Tactics to strengthen supply chain cybersecurity

Third-party cybersecurity presents complex challenges that require comprehensive, layered approaches. These are some strategies you can use to help fortify security:

1. Risk assessment and management
2. Collaboration with suppliers
3. Employee training and awareness
4. Implementing security protocols
5. Continuous monitoring and updates
6. Incident response planning

Let’s look at each in detail.

1. Conduct a risk assessment

Before taking any steps, assess possible threats and identify where they lie. The most common causes of breaches include:

• Application vulnerabilities.
• Stolen or weak credentials.
• Insider threats.
• Excessive permissions.
• Malware.
• User error.

As part of your risk assessment:

• Identify and document all vendors with access to systems or data. For each vendor, assess the type of access granted, data shared and potential effects if compromised.
• Some organizations now require suppliers to maintain specific certifications, such as ISO 27001 or SOC 2 Type II compliance.
• Consider following the Plan-Do-Check-Act cycle recommended by the European Union Agency for Cybersecurity, ENISA, for supply chain cybersecurity. Integrate security considerations into procurement processes, establishing security requirements before engaging new vendors.
• If appropriate, consider using specialized third-party risk-management platforms to automate assessment processes and maintain visibility.

2. Collaborate with suppliers

Supplier relationship management is important. According to the 2024 Global Cybersecurity Outlook, 41% of organizations that suffered material effects from cyberattacks report that those attacks originated from third parties. That’s an astounding number.

To help keep you from being among that 41%, take the following collaboration actions:

• Establish clear security requirements for all vendors and incorporate these standards into contracts and service level agreements (SLAs).
• Create a tiered system that requires more rigorous controls for suppliers that handle sensitive data or access critical systems.
• Plan meetings and visits to review policies to enhance security and resilience.
• Communicate your security standards and needs, and make sure they align with your entire supply chain.
• Some industries have established Information Sharing and Analysis Centers (ISACs) specifically focused on supplier threats, allowing coordinated defensive measures across entire sectors.

3. Conduct employee training

Comprehensive training programs should address both general cybersecurity awareness and supply chain-specific threats. Actions to take can include:

• Implement role-specific training for workers who manage vendor relationships, focusing on recognizing social engineering attempts targeting third-party relationships.
• Conduct simulated phishing exercises that mimic supply chain-specific scenarios, such as fake vendor communications requesting credential verification or payment changes.
• Establish clear procedures for verifying communications related to supplier management, especially those involving financial transactions or access changes.
• Create reporting mechanisms for suspicious activities and reward employees who identify potential threats.

4. Implement security protocols

Robust cybersecurity practices are vital, and some important steps include the following:

• Begin with a zero-trust architecture that verifies every user and device attempting to access resources, regardless of location or previous authentication.
• Implement multi-factor authentication for all supply chain systems.
• Follow least privilege principles for strong access controls so vendors can only access what’s needed for their specific functions.
• Critical and protected information should be encrypted and stored in secure files that are regularly updated with new encryptions to keep up with the latest technologies.
• Use data loss prevention tools that monitor unauthorized information transfers. Implement endpoint detection and response solutions capable of identifying suspicious activities.
• Segment networks to isolate supplier management systems from your resources, limiting lateral movement if third-party defenses are breached.
• For critical operational tech environments, maintain air-gapped networks where possible to keep attacks from compromising production systems.

5. Conduct continuous monitoring and updates

Mitigating vulnerabilities requires nonstop vigilance. Actions to take include these:

• Establish continuous monitoring systems to detect anomalous behavior across supply chain networks and applications.
• Implement automated scanning tools that regularly check for known vulnerabilities in both internal systems and vendor-provided solutions.
• Create a formal patch-management process prioritizing updates based on risk level and effects. For critical systems where immediate patching might disrupt operations, implement compensating controls while planning for maintenance windows.
• Conduct regular penetration testing targeting supplier systems and third-party connections. Some IT organizations use “purple team” exercises where internal defenders work with ethical hackers to improve detection and response capabilities.

6. Establish an incident response plan

Because of the unforeseeable nature of risks, this is critical. In fact, KPMG’s Global Tech Report 2024 stresses the importance of effective continuity planning to prevent, respond to and recover from disruptions so essential functions and core revenue-generating processes are sustained.

Include roles, procedures and conditions for incident response, plus a communication strategy for telling customers and partners.

This means CIOs and CISOs should build a resilient technology stack and IT operating model to manage unexpected problems and maintain process integrity.

Visibility is the first line of defense

You can’t secure what you can’t see — and in many organizations, third-party transparency is still fragmented. To that end, IT leaders should establish a comprehensive view of:

• All third-party vendors and their access to systems and data.
• Software dependencies, including open-source components.
• Data flows between internal systems and external partners.

This requires integrated tooling, real-time monitoring and a living inventory of the digital supply chain.

Software development and cybersecurity are inseparable

For many enterprises, the greatest risk lies in the software they rely on, not just who they work with.

Apps are built on layers of third-party code, APIs and libraries. To address this, IT organizations can:

• Implement software bills of materials (SBOMs) to track dependencies.
• Scan for vulnerabilities continuously across the development life cycle.
• Secure CI/CD pipelines to prevent tampering and unauthorized changes.

A challenging battlefield

If your supply chain has been a blind spot, it’s time to look. Because now, it’s a combat zone. And that can be a bit startling, considering everything else you’re responsible for. But it needs to be dealt with using observability, governance and strategy.

Securing your suppliers requires a fundamental shift in mindset — from perimeter defense to ecosystem resilience, and from reactive response to proactive risk management.

And treat supply chain cybersecurity as a strategic priority. After all, your enterprise is only as secure as the weakest link in your supply chain.