5 steps to strengthen cyber defences against third-party risk
Following a wave of high-profile cyber-attacks on major UK retailers including M&S, Co-op and Harrods, cyber security experts from around the country are urging companies to tighten supply chain security to avoid becoming the next headline. Katherine Kearns from S-RM shares five key steps organisations can take to strengthen their cyber defences against third-party risk.
1) Identify critical vendors
Begin by understanding the organisation’s third-party exposure and the impact this can have on the business. It is particularly important to identify and inventory third-party suppliers that have access to sensitive data, have access into your internal environment, provide critical software, and could significantly affect business continuity if disrupted.
2) Implement continuous monitoring
Move beyond point-in-time assessments. Use automated tools and threat intelligence to continuously monitor vendor security postures and flag emerging risks.
3) Integrate vendors into continuity plans
Validate business continuity and disaster recovery plans adopted by the suppliers and align your own incident response and business continuity plans with them. Establish redundancies and workarounds to avoid single points of failure. Exercise disruptive scenarios with critical suppliers to improve joint recovery processes, exercise communication plans during critical events, and build muscle memory around critical decision-making.
4) Mandate security controls contractually
Include clear security obligations in supplier contracts. These should cover access controls, encryption standards, breach notification protocols and right-to-audit clauses. Include compliance with the contractual security obligations in the security posture assessment of the critical third-parties.
5) Secure your own perimeter
Strengthen your internal defences to mitigate damage if a third-party is compromised. Prioritise measures around:
- Employee training and social engineering awareness, including implementing additional security verification procedures to prevent impersonation of employees and third-parties with access to the environment
- Heightened security protocols for account reset or credential reminder requests
- Enhanced monitoring of third-party user activity
- Continuous identification and monitoring of the external attack surface, including new internet-facing assets and vulnerable remote access methods
Hacks in retail
In recent weeks, the UK’s retail sector has been rattled by high-profile cyber hacks. At M&S, hackers gaining access to its systems via one of its contractors through the use of advanced social engineering techniques. M&S chief executive, Stuart Machin, said it will take an estimated £300 million hit to profits this year from the damaging cyber-attack that it expects to disrupt its online business into July.
Earlier, Harrods and Co-op also faced hack incidents, although they have had less of an impact than the M&S attack.
The National Cyber Security Centre (NCSC) is working with both M&S and the Co-op, while the Metropolitan Police's Cyber Crime Unit and the National Crime Agency (NCA) is investigating the M&S attack.
