Cybercriminals continue to target supply-chain weaknesses
Cybercriminals are increasingly targeting supply chains, as they look to take advantage of vulnerabilities within third parties to gain access to key data. Experts from IT and risk consultancy Northdoor suggest that AI powered solutions could be used to provide a better overview of these weaknesses, and address them before they can be exploited.
2023 has seen a glut of high-profile cyber-attacks appear in the news agenda – and the rise of a distinct new phenomenon: the supply-chain hack. Such hacks are reported regularly, as cybercriminals continue to take advantage of vulnerabilities within third parties to gain access to valuable information and customer resources.
One of the latest hacks has seen identity and access management provider Okta hit by a breach that exposed private customer information. Cybercriminals leveraged stolen credentials to gain access to Okta’s customers data – particularly the credentials of an access management provider, which gave the hackers the additional bonus of appearing completely legitimate.
The nature of Okta’s business means that it is a tempting target for cybercriminals as once they have secured access, they can quickly get into multiple customers infrastructure. As a result, Okta has been the victim of multiple breaches, including twice in 2022. Ironically, Okta has also been the end victim recently of a supply chain attack, where its healthcare benefits partner, Rightway Healthcare was hacked, leaving the details of Okta employees exposed.
The fact that security firms are vulnerable to attack should be an eye-opener to most companies as should another recent supply chain hack that targeted the public sector. According to Northdoor CCO AJ Thompson, this should encourage all companies need to quickly step up their ability to close vulnerabilities across their entire supply chain.
“These recent hacks are a microcosm of why supply chain hacks are so effective,” Thompson explained. “One successful breach into a company can gain access to multiple companies’ data, often without the end victim knowing that they’ve even been attacked. The fact that these latest examples are also across both the private and public sectors show that all sectors are at risk, there is not one company or organisation in the UK that should not be worried about the potential threat coming from their supply chain.”
Northdoor is an IT consultancy in London helping organisations drive value from their business data assets. Showing how the firm works with clients to safeguard its assets, it partnered with the Salvation Army in 2021, to implement its RiskXchange solution – which it designed, developed and implemented. The solution helps organisations with mapping their partner and client ecosystem for an integral view of cyber risks.
Thompson added that projects such as this will be increasingly important parts of a firm’s cyber-security ecosystem in the future – or even finding ways for AI to give a holistic overview of a supply-chain. After all, even the smallest companies can have access into larger companies’ infrastructure which, as has been seen time and time through 2023, again allows cybercriminals into infrastructure that would otherwise struggle to get to.
Concluding, Thompson added, “The traditional method of ascertaining how secure a partners’ system is tends to be in the form of a questionnaire. This of course means that you have rely on the knowledge and honesty of the person filling in the form – this is no longer an acceptable method to ensure your systems are secure. The key is to have visibility over your entire supply chain, shutting the back-door on the cybercriminal trying to gain access. Some companies are turning to AI powered solutions that can provide a 360-degree view of their supply chain and where the vulnerabilities lie. All companies have to look to alternative solutions that deliver the real-time view of potential access points for cybercriminals.”
