How Do I Protect My Business from Supply Chain Attacks?

Why Supply Chain Attacks Work

You've hardened your defences. Attackers notice. Instead of attacking you directly, they attack someone you trust:

• Your software provider (malicious update)
• Your managed service provider (access to your systems)
• Your cloud vendor (infrastructure compromise)
• Your supplier (invoice fraud, data theft)

When trusted software or partners are compromised, your defences often let the attack straight through.

Major Supply Chain Attacks

SolarWinds (2020) Attackers compromised SolarWinds' build system. Malicious code shipped in legitimate software updates to 18,000+ organisations including government agencies.

Kaseya (2021) REvil ransomware deployed through Kaseya's VSA software, hitting thousands of MSP customers simultaneously.

MOVEit (2023) Zero-day in MOVEit file transfer software. Cl0p ransomware group stole data from hundreds of organisations through their file transfer vendor.

3CX (2023) Popular business phone software compromised. Legitimate, signed updates contained malware.

These attacks share common features:

• Trusted software or vendor compromised
• Legitimate update/access mechanisms abused
• Wide blast radius
• Difficult to detect

Types of Supply Chain Risk

Software supply chain

• Compromised software updates
• Malicious code in dependencies
• Vulnerable open source components
• Compromised build/distribution systems

Service provider risk

• Your MSP/MSSP gets breached
• Cloud provider compromise
• SaaS vendor breach
• Outsourced service compromise

Business supplier risk

• Partner credential theft (BEC)
• Supplier impersonation fraud
• Data breach at supplier holding your data

How to Reduce Risk

1. Know your supply chain

Inventory your vendors:

• What software do you run?
• Who has access to your systems?
• Who holds your data?
• What cloud services do you use?

You can't manage risk you don't know about.

2. Assess vendor security

Due diligence questions:

• What security certifications do they have?
• How do they secure their development/delivery?
• What's their incident response process?
• How will they notify you of breaches?

Proportionate assessment: Apply more scrutiny to higher-risk vendors (access to sensitive data, privileged access, critical services).

3. Minimise access and blast radius

Least privilege for vendors:

• Only necessary access
• Time-limited where possible
• Separate accounts (not shared)
• Monitor vendor activity

Segmentation:

• Don't give vendors domain admin
• Isolate vendor-accessible systems
• Limit what compromised vendor could reach

4. Monitor for compromise

Detection capabilities:

• EDR on all systems
• Monitor for unusual software behaviour
• Alert on unexpected connections
• Watch for post-compromise indicators

Even trusted software can turn malicious.

5. Prepare for vendor incidents

Incident response planning:

• What if critical vendor is compromised?
• Can you isolate their access quickly?
• Do you have contact information for security issues?
• What's your communication plan?

6. Contractual protections

Include in vendor contracts:

• Security requirements
• Notification obligations for breaches
• Audit rights
• Liability provisions

For Vendors: Becoming Trustworthy

If you're a supplier, customers increasingly assess your security:

• Certifications: Cyber Essentials Plus, ISO 27001
• Questionnaires: Be ready to answer security questions
• Evidence: Provide documentation of controls
• Transparency: How do you secure your supply chain?

We help our clients both assess their suppliers AND demonstrate their own security to customers.

What We Do

For our clients:

• Vendor risk assessment frameworks
• Security questionnaires and due diligence
• Contract security requirements
• Ongoing vendor monitoring

As your vendor:

• We're ISO 27001 and Cyber Essentials Plus certified
• We practice what we preach
• We're transparent about our security
• We have incident response procedures