Today, no vendor or agency is safe—and just as importantly, no single organization can address all these threats independently.
The recent cyberattacks against SolarWinds and other widely used technology providers demonstrates the lengths to which foreign nation-states and other hackers are willing to go to achieve malicious objectives. By targeting private sector organizations within the technology supply chain, bad actors have made the security posture of government organizations more vulnerable.
Bad actors can carry out these attacks in part because our current, unprecedented environment has permanently expanded the threat landscape. Today, no vendor or agency is safe—and just as importantly, no single organization can address all these threats independently. There must be collaboration among industry players—as well as between industry and the public sector—if we hope to establish a security posture capable of combatting these supply chain threats.
All this said, we’re at a point where we must take a step back and assess our collective security postures from square one to secure the larger supply chain. There are three overarching strategies the public and private sector can use to dramatically enhance security and more effectively secure the supply chain:
- Create a zero-trust environment.
- Perform real-world testing.
- Identify, secure, and form partnerships within the supply chain.
How can agencies and contractors carry out these strategies? Let’s take a closer look.
Zero Trust
Right now, the top attack vector is exploiting trust—human trust between supply chain partners, the trust we have between our applications, and the trust we have inside of our networks. The goal is to evolve from implicit trust—which far too many organizations have right now—to zero trust.
Start by thinking about how to ensure users, devices, networks, and applications have either zero trust or least-privileged access principles implemented. Consider implementing a Secure by Design approach taking a 360-degree perspective, considering the entire environment as opposed to focusing on point problems, which too often lead to point solutions.
In fact, when creating a Secure by Design strategy, start by looking at zero trust as a mindset—or a set of principles—followed by tools and practices. A longer-term, bigger-picture approach will be far more effective.
Real-World Testing
With a zero-trust plan in place, the second goal is to test your organization’s risk. It’s critical to know the absolute, unvarnished truth about your risk profile.
It’s far too easy to assume you’re less at risk than you actually are. You’ve met compliance requirements, you have technologies and processes in place, you have an enterprise-wide dashboard; few to none of these things are risk informants. That’s what testing supports.
Can somebody break into your network and get to an industrial control system? Find out by testing. Perform the test, study the results, and adapt accordingly. Afterward? Keep testing and continue adapting. Most organizations have strong security products in place for defending their environment, but it’s imperative to continue to tweak processes, update procedures, and ensure the software in place is used to its fullest capacity. It’s critical to continually test the environment to know for sure you’re making progress.
Without testing, you’re working in a vacuum.
Identify and Secure the Supply Chain
Finally, and most importantly for this discussion, know your supply chain. With whom does your organization have contracts? Whom do you pay to help with day-to-day operations?
Particularly for large organizations, this can be a wildly complex proposition. There will be primary providers—who are billing you for services —and secondary and tertiary providers. There will also be upstream and downstream providers, making it critical to research and uncover every single organization with which you do business.
Once you’ve created a list of providers, the next step is to prioritize them. Which providers have a direct impact on users or customers? What products do they support? What business processes do they support? How important are they to your mission or your bottom line? Consider if you have any “concentration risks”—does any part of your supply chain rely on only one or two providers? This may be a risk factor.
Once partners are prioritized, consider how your organization wants to work with each one. Do you want contractual agreements with each partner? Contracts can help set and manage expectations, help your organization understand the risk profile of your partners, and—just as importantly—map out your organization’s security requirements.
The thing to remember when it comes to supply chain security is it’s ongoing; it’s going to be a continuous iteration, improvement, and evolutionary process. You’re never going to be “done,” and that’s OK. Embrace the journey; your organization will reap the benefits.
Brandon Shopp is group vice president of product strategy for SolarWinds.
