How Do I Protect My Business from Supply Chain Cyber Attacks?

Quick answer: You can't eliminate supply chain risk, but you can manage it. Assess vendor security before contracting, limit what vendors can access, monitor for compromises, and have a plan for when (not if) a supplier is breached.

Why Supply Chain Attacks Work

Attackers have learned:

• Direct attacks on hardened targets are difficult
• Suppliers often have weaker security
• One compromised vendor = access to many victims
• Software supply chain = automatic distribution to targets

Recent examples:

• MOVEit (2023): File transfer software vulnerability hit thousands of organisations
• 3CX (2023): Compromised business phone software distributed malware
• SolarWinds (2020): Infected updates reached 18,000 organisations
• Kaseya (2021): MSP software used to deploy ransomware to customers

You're only as secure as your least secure supplier.

Types of Supply Chain Risk

Software supply chain:

• Compromised software updates
• Malicious code in open-source libraries
• Backdoored development tools

Service provider risk:

• MSPs and IT providers (like us) with access to your systems
• Cloud services holding your data
• Outsourced business processes

Hardware supply chain:

• Tampered equipment
• Firmware compromises
• Counterfeit components

Business partner risk:

• Third parties with data access
• Integration partners
• Contractors and consultants

Managing Third-Party Risk

1. Know your suppliers

Inventory:

• All vendors with system access
• All vendors with data access
• All software and where it comes from
• All cloud services

Classify by risk:

• Critical (system access, sensitive data)
• Important (business dependency)
• Standard (limited access/data)

2. Assess before contracting

Due diligence questions:

• What certifications do they hold? (ISO 27001, SOC 2, Cyber Essentials)
• How do they protect your data?
• What's their incident response process?
• Will they notify you of breaches?
• What's in their security questionnaire?

Proportionate approach:

• Critical vendors: Detailed assessment, possibly audit rights
• Important vendors: Security questionnaire
• Standard vendors: Basic checks

3. Contract for security

Include:

• Security requirements
• Breach notification obligations (timeframes)
• Audit rights
• Subcontractor controls
• Incident cooperation
• Exit provisions (getting data back)

4. Limit blast radius

Principle of least privilege:

• Minimum access necessary
• Segment vendor access
• Separate credentials
• Monitor privileged access

If a vendor is compromised, limit what attackers can reach.

5. Monitor continuously

Ongoing visibility:

• Monitor vendor access to your systems
• Track security posture changes
• Watch for vendor breach notifications
• Subscribe to threat intelligence

Don't assess once and forget.

6. Plan for vendor breaches

When (not if) a supplier is breached:

• How will you know?
• What's your response process?
• Can you isolate their access quickly?
• Who makes decisions?

Quick Assessment

Ask yourself:

• Do you have a complete vendor inventory?
• Are critical vendors formally assessed?
• Do contracts include security terms?
• Can you revoke vendor access quickly?
• Would you know if a vendor was breached?

If you answered "no" to any of these, you have work to do.

What We Help With

Third-party risk management:

• Vendor inventory and classification
• Security assessment frameworks
• Due diligence questionnaires
• Contract security terms

Technical controls:

• Privileged access management for vendors
• Network segmentation
• Monitoring and alerting
• Incident response for vendor-related breaches

For our managed clients: We're a supplier too—we take this seriously. We're ISO 27001 certified, CE+ certified, and transparent about our own security practices.

---

about third-party risk management.

---