Reducing cyber risk in your supply chain in 2024

GUEST OPINION:  Cybersecurity breaches targeting supply chains within Australian organisations continue to intensify. Our recent ‘State of Supply Chain Defence: Annual Global Insights Report’ reveals that the number of cyber breaches targeting Australian organisations’ supply chains continues to rise, with an average 4.06 breaches reported to be negatively impacting operations in 2023 — a 17% increase from the mean number of 3.48 breaches in 2022.

Moving into 2024, organisations need to examine their current approaches and identify areas for greater efficiency and continuous coverage — not only in detecting emerging vulnerabilities and risk, but also in quickly remediating threats with impacted third parties.

Supply chains — an attractive target

Organisations are only as secure as their weakest third-party link and unfortunately, when this weakness is leveraged by cybercriminals, it can set off a domino effect of security risks with long-term negative impacts on the company finances, reputation, employee welfare, and customer’s personal data.

It is critically important that companies understand their extended digital supply chain, or the suppliers, vendors, and other third-parties that have direct or indirect access to their network. Organisations need to know who they are connected to and what access these third parties have. If a third party gets breached, this breach can then compromise the main organisation and result in data loss, ransomware, or business interruption.

In addition, organisations need to be ready for interconnected supply chain disruptions that can originate from many sources, including natural disasters, geopolitical conflicts, security issues, and more. Before a disruption happens, it is important to understand who you are relying on and have a backup to ensure business continuity. Organisations should also continuously monitor their digital supply chain and quickly work with third parties to remediate when issues arise.

Key challenges for 2024

It has become harder for organisations to identify basic externally facing vulnerabilities and threats due to sheer volume, and threat actors are increasingly taking advantage of these exposures, pivoting, and evolving their tactics to achieve their goals. Social engineering attacks using generative AI will continue to increase in sophistication. Generative AI tools will enable attackers to create more personalised and craftier approaches, more frequently and with greater success. On top of this, organisations must now respond to potential threats much quicker as attackers have gotten quicker to exploit vulnerabilities.

 Mitigating these risks will hinge largely around organisation-wide awareness and education. Organisations must prioritise securing their supply chains to counter these threats effectively. These defensive efforts are crucial, given that threat actors have found success by using these TTP (Tactics, Techniques, and Procedures), as long as these methods yield results, threat actors will continue these types of attack methods.

Prepare for Supply Chain Threats 

There’s no silver bullet when it comes to reducing cyber risk in the supply chain. Some of the biggest challenges that cybersecurity professionals continue to face include a lack of personnel to orchestrate all critical tasks, an abundance of data and information that needs to be analysed without enough personnel, and a lack of automation for tasks that can be automated.    

The ubiquitous use of cloud demands improved cloud security. Stringent security measures need to be implemented to safeguard the data stored there. Real time detection and response of suspicious activity is important. Monitoring all data activity using alerts and logs is extremely important and detection and response times to incidents needs to be immediate not days.   

 As organisations look to mature their supply chain risk defenses in this year and beyond, here are four recommendations to combat common pain points: 

• Diversify Suppliers: Have a plan for alternative suppliers in different countries or regions. Conduct a thorough analysis of the cost, quality, and reliability of these suppliers to ensure a smooth transition if necessary.  
• Risk Assessment: Continuously assess the geopolitical and economic risks and your supply chain strategy accordingly. Stay informed about trade policies, tariffs, and regulations that may impact your operations.  
• Regionalisation: Explore regional supply chain strategies that reduce your dependence on a single country.   
• Regulatory Compliance: Stay up to date with trade regulations and sanctions that may affect your business. Ensure that your supply chain practices are compliant with these regulations.  
• Contingency Planning: Develop comprehensive contingency plans that outline steps to take in the event of a supply chain disruption, including alternative sourcing and logistics strategies.  

As Australia and the wider Asia Pacific region continues to embrace digital transformation and the ongoing cyber threat, organisations and individuals must prioritise robust cybersecurity strategies and maintain resilience. Remember that diversifying your supply chain is complex and a long-term process. It requires careful planning and risk assessment to ensure a smooth transition while maintaining the quality and efficiency of continuing your operations in the chance that an event occurs.