A New York couple has pleaded guilty to money laundering in connection with hack of cryptocurrency exchange Bitfinex, which led to the theft of about 120,000 bitcoins.
382 
Supply chains are the networks between a company and the suppliers it relies on to produce and distribute the company’s products or services. Supply chain management involves managing the flow of goods, including all processes involved in transforming raw materials consumed by an organization into finished products or services that the organization provides. Supply chain management includes the planning and management of all activities related to the sourcing, procurement and processing of raw materials, as well as logistics management functions.
One of the main reasons why companies implement a global supply chain management strategy is to strengthen their competitive advantage. However, many of the benefits that come with supply chains can also increase an organization’s risk to quality, safety, business continuity, reputation, and cybersecurity.
Since the start of the COVID-19 pandemic, supply chains have become increasingly prominent in the media as the effects of supply chain disruptions have reached the homes of ordinary consumers around the world. The pandemic has highlighted the vulnerability of traditional supply chains to such disruptions. Every business faces internal and external risks related to supply chain disruptions. Managing the risks associated with such disruptions is called supply chain risk management (SCRM).
Supply chain risk management is the process of identifying, assessing, prioritizing and mitigating threats to your supply chain and the risks they pose. An important element of supply chain risk management is third party risk management (TPRM). Organizations in almost every industry work with some type of third party throughout their supply chain, whether they are suppliers, subcontractors, or service providers. The nature of these business relationships inevitably exposes these organizations to potential risks.
Research shows that on average, organizations share their data with approximately 730 suppliers. Of those organizations that share data with third parties, 53 percent experienced at least one data breach caused by a third party, with an average loss of about $7.5 million . In addition to data breaches, other external supply chain risks include those caused by unpredictable or misunderstood consumer demand; interruptions in the supply of products, including raw materials, parts and finished products; natural disasters such as earthquakes, hurricanes and tornadoes; and more.
Meanwhile, internal supply chain risks may include risks caused by disruptions in internal operations; changes in key management, personnel and business processes; non-compliance with environmental regulations or labor legislation; lack of adequate cyber security policies and controls to protect against cyber attacks and data leakage; and more. However you look at it, your organization’s involvement in the supply chain (including outsourcing to third parties) inevitably creates risk for your organization. Whether it’s legal risk, compliance risk, financial risk, strategic risk or reputational risk, the supply chain exposes your business to numerous potential disruptions that it might not otherwise face.
Perhaps the most serious risk to your business is cyber risk in your supply chain: the potential for a cyber security incident to disrupt your data and business operations. As organizations continue to rely more and more on third parties, and the number of cyber security incidents increases in line with this trend, it is more important than ever that your organization creates and executes a supply chain risk management plan to protect your business and customers. and any other business activity. relationships, from potential disruption risks to supply chain cybersecurity.
As we noted above, cyber risk is an increasingly important risk that supply chains present to organizations. Unfortunately, most organizations operating along the supply chain will eventually experience some type of disruption in data, finance or business operations. How these disruptions in turn affect your business will be determined by the effectiveness of your supply chain risk management strategy.
As the business environment becomes increasingly digital, the Internet of Things (IoT), Industrial Internet of Things (IIoT), and other digital technologies will continue to play an important role for many organizations, especially in optimizing their supply chain operations. However, these new technologies also expose businesses to new cybersecurity threats, such as malware, ransomware, phishing, and hacking.
Some of the most common risks affecting organizations along the supply chain today include data breaches, cyber security breaches, and malware and ransomware attacks. Next, we’ll take a closer look at each of these cyber risks and how they can hurt your business.
Data breaches are one of the most serious cybersecurity threats facing organizations today. It is likely that the frequency and severity of these security incidents will continue to increase in the coming years. When an organization experiences a data breach or data breach, it often results in significant financial losses and reputational damage, in addition to legal and regulatory ramifications.
In 2021, the average cost of a data breach is $4.2 million. According to one study, even with the right regulatory and compliance standards in place, organizations often take a long time to detect a data breach after it has occurred: approximately 197 days. Even worse, this number grows when organizations become data leaks following supply chain security incidents. IBM and the Ponemon Institute report that it takes a company an average of 280 days to detect a third-party data breach.
The more you share sensitive data with third parties in your supply chain, the more likely your data will be compromised or leaked. Sensitive data is information that must be protected from unauthorized access to protect the privacy or security of an individual or organization. This can be in the form of intellectual property or personally identifiable information (PII).
Some of the most common data breaches caused by third-party vendors are the result of unauthorized access through a company email account, email service provider hacking, lack of encryption, insecure websites, and improperly stored login information.
In some cases, third parties can even maliciously leak sensitive customer data outside of the business, leaving your organization vulnerable to supply chain attacks from cybercriminals, hackers, and even rogue states.
This category is intentionally expanding as there are a number of new technologies that make organizations more vulnerable to cyber-attacks throughout the supply chain in ways never seen before. Today, any device connected to the Internet poses risks to the supply chain. For example, IoT often refers to consumer devices such as personal fitness trackers or smart thermostats; in 2021, there will be more than 10 billion active IoT devices in the world. IoT is specifically about devices that support a much larger business.
IIoT is designed to accelerate manufacturing and includes devices connected and sharing data over the Internet, from sensors and scales to motors and elevators. These technologies help organizations improve efficiency, including faster time-to-market, better tracking of assets along the supply chain, lower costs, safer workplaces, and more. They also pose a number of cybersecurity risks to the organizations that use them. Cybercriminals know that IoT and IIoT security is not the best, making them easier targets for cyberattacks.
According to 2019 IoT-based attack statistics, the average IoT device is attacked just five minutes after launch. For IIoT devices running industrial systems, the consequences of a cyber security breach can be far more devastating: loss of production, impact on revenue, data theft, significant equipment damage, industrial espionage, and even personal injury. As more devices and sensors come online, they will continue to create new communication channels, data stores, gateways and endpoints. This increased attack surface creates even more vulnerabilities if these endpoints are not secured.
Malware and ransomware attacks are unfortunately becoming more common. These attacks are designed to steal information, change internal data, or destroy confidential information.
Malware is any intrusive software that can infiltrate your computer systems to damage or destroy them or steal data from them. The most common types of malware attacks include viruses, worms, trojans, and ransomware.
One of the most memorable malware attacks in recent history is the 2020 SolarWinds malware attack. Earlier this year, cybercriminals breached the systems of SolarWinds in Texas and added malicious code to Orion’s software system, which was widely used by approximately 33,000 of their customers to manage their IT resources.
In March 2020, SolarWinds sent software updates to customers using Orion that included malicious code that hackers installed. The malware then created a backdoor into SolarWinds customers’ IT systems, allowing cybercriminals to install even more malware to target those companies and organizations.
Another popular type of malware attack is ransomware. This form of malware encrypts the victim’s files, allowing the attacker to demand a monetary payment in exchange for the decryption key. In most cases, the monetary exchange for the decryption key to recover your data is done using cryptocurrencies such as Bitcoin to hide the identity of the attackers.
In 2021, a ransomware attack on Colonial Pipeline forced the company to shut down operations for several days, leading to gasoline shortages in the southern United States. The hackers first gained access to Colonial’s networks through a virtual private network (VPN) account that allowed its employees to remotely access the computer network. However, the VPN did not require multi-factor authentication to gain access, allowing attackers to breach Colonial’s network using only a compromised username and password – information likely obtained in a data breach that exposed an employee’s login credentials.
Colonial eventually paid the hackers $4.4 million in exchange for a decryption key to recover their data. However, the decryption key was so slow that the company still had to rely on its own backups to restore service. Colonial Pipeline was eventually able to resume operations, but only after a devastating blow to their business that resulted in a number of financial and reputational consequences.
To protect your organization and its customers from the cyber risks described above (and others), your company can implement a number of supply chain risk management best practices. Here are some ways to strengthen your cybersecurity defenses against the above cyber risks:
Setting compliance standards for all your third-party suppliers, including manufacturers, suppliers and distributors.
Clearly defining user roles and implementing security measures to limit access to your systems and what level of permission or privilege they have. This is known as the principle of least privilege.
Defining and documenting data governance standards and defining who owns certain data and what they are allowed to do with that data.
Conducting full safety training for all your employees.
Collaborate with suppliers in your supply chain to develop a unified disaster recovery plan to ensure business continuity.
Setting up backup controls to protect your data backups.
Regular software updates, including anti-virus, anti-spyware and firewalls. You should also consider more advanced cybersecurity tools, such as DNS filtering and network access control.
Choosing a software solution like Reciprocity’s ROAR platform provides complete visibility into the risks in your supply chain so you can quickly identify risky behavior or unusual activity.
Now that we have a better understanding of some of the most common supply chain cyber risks, it’s time to look at the steps you can take to implement a successful supply chain risk management strategy that works best for your business.
As with any risk management program, the first step is to make sure you have the right people in place to succeed. It is necessary to assemble a team of people who can identify, analyze, prioritize and mitigate risks in the supply chain.
Once you have your team, start the planning phase together. Define specific roles and responsibilities for your team members, create or incorporate an existing supplier risk management policy, and decide how you will detail the procedures and processes you will use for each step of your supply chain risk management strategy.
A detailed risk management plan is the most reliable way to prepare your team and the wider organization for the inevitable risks you will face along the supply chain. Cyber risk management requires you to pay close attention to the risks that affect your cybersecurity and where those risks can harm your organization along the supply chain.
You will also need to establish some metrics to measure risk; Whether you choose to use qualitative measurements, such as a high/medium/low scale, or quantitative measures, such as statistical analysis, is up to you. Ultimately, you should choose the methodology that best suits your business needs.
Before starting the next step, you should also spend some time referencing any existing frameworks that can help along the way. Fortunately, there are a number of risk management systems and approaches that can be used when establishing or strengthening a supply chain risk management program. Start with the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO) for examples of risk management mechanisms that can help your organization begin the regulatory journey at its own risk.
Before you can reduce risk, you must first determine that it exists. During the risk identification phase, your team should engage in tabletop exercises to identify existing risks, as well as think about any potential risks that have not yet been identified. This includes making a list of your supply chain risks so you can begin to analyze them.
You should also take this opportunity to review your service level agreements (SLAs) for each third party you have in place to ensure your vendors are performing as they should and to determine compliance requirements for your organization. Your organization should always know what norms and standards both you and your third parties must comply with.
Next, start the risk analysis process. Start by conducting a supply chain risk analysis, either in-house or by an independent cybersecurity firm or specialist. A risk assessment will help you determine the nature and extent of identified risks along the supply chain so you can categorize your contractors by risk and level of access.
Ultimately, a cybersecurity risk assessment should provide you with an in-depth analysis of all of your cybersecurity risks, including those in your supply chain.
Assign a risk level to each risk and categorize supply chain risks by type. Then prioritize these risks according to their respective risk levels. As a general rule, you should deal with the highest level risks first and then move down the list according to risk priority.
Once you’ve determined which risks need your attention first, decide how to deal with each one. For each risk, you need to decide whether to accept, reject, transfer or mitigate the risk. Regarding supply chain risk, sometimes the best plan may simply be to find another, less risky supplier.
It is also important that you regularly survey your third parties using risk management questionnaires to determine whether existing risks have been adequately mitigated and whether new risks have emerged. Whether you use a template from one of your existing risk management systems or create your own, questionnaires and regular inquiries should be designed to help you scrutinize the security measures that third parties apply to their workflows.
Any particularly high-risk third parties may even require an audit, depending on the responses they provide to your questionnaires. In some cases, you may need to visit the location when necessary.
Once you have completed the above steps, you will need to start the process over. Supply chain risk management is an ongoing process for every third party along your supply chain; it is a process that should be repeated frequently throughout the lifecycle of the third-party relationship.
Continuous monitoring is a necessary practice because your business partners can and do constantly change their processes. Keeping up with changes in your own business, your supply chain, as well as changes in regulations and industry standards is not an easy task, but it is necessary.
In many cases, due diligence alone is not sufficient for cybersecurity. Continuous monitoring can limit potential cyberattacks and data leaks for both your organization and third parties in the supply chain.
At some point, many organizations have to admit that they cannot handle the entire supply chain risk management process on their own. And unless you’re a large enterprise, risk management can be an expensive and time-consuming process that many small businesses simply can’t afford to do in-house.
For businesses looking for a solution, there is software that can help. Governance, risk management and compliance (GRC) software can help you master your risk management program, particularly for cyber risks. With simple and automated supply chain risk management tools, you can improve your supply chain and reduce the burden on internal teams.
After major supply chain disruptions and cyberattacks like those at SolarWinds and Colonial Pipeline, it’s time for your organization to take a closer look at your supply chain (including suppliers with privileged access to your company’s assets) and the risks they pose. to your business. Fortunately, there are security solutions designed to help.
Reciprocity ZenRisk is an integrated cybersecurity risk management solution designed to provide you with actionable insights to gain the visibility you need to stay ahead of threats and communicate the impact of risk on high-priority business initiatives.
Turn the unknown into quantifiable and actionable risk information with built-in experts that identify and map risks, threats, and controls for you, so you can spend less time configuring your application and more time using it. A single, real-time view of risk and business context empowers you to communicate with your board and key stakeholders based on their priorities, while keeping your risk posture aligned with the direction your business is taking.
ZenRisk Reciprocity will even automatically notify you of any changes or actions required, so you can control your risk like never before. Eliminate tedious manual work and simplify collaboration by automating workflows and integrating them into your most important systems.
In addition, Reciprocity ZenRisk is fully integrated with Reciprocity ZenComply, so you can use your compliance operations to improve your risk position with AI.
Reciprocity’s suite of products, built on Reciprocity’s ROAR platform, provides the ability to see, understand and act on IT and cyber risks. Now, with a more proactive approach, you can make time for your team with Reciprocity ZenRisk. Talk to an expert today to learn more about how Reciprocity’s suite of products can help your organization reduce cybersecurity risks and stay ahead of threats.
382 
356 
344