Supply Chain Security: Three important focus areas for immediate and measurable results

It’s easy to imagine how one might be a backdoor into a military contractor if they supply them with services or tools, but would you consider your local nail salon to be a supply chain risk? Well, you should. In fact, a recent attack against a large company began by compromising a local salon and using their billing system to send malicious PDFs to executives at the company who used their services.

Where to Start

There’s tremendous opportunity for MSPs and MSSPs alike to improve supply chain security defenses – both internally and for the customers that they serve.

This might seem like a daunting task, but you can tackle it – often with immediate and measurable results – by focusing on three important areas:

1. Authentication

Service providers need to stop sharing passwords. It sounds like common sense, but it’s an ongoing problem.

As someone who has investigated credit card fraud, I’ve seen firsthand the risks of payment terminal providers using remote access software – with a single, shared password to manage thousands of customer accounts.

This lack of security is no longer acceptable. Phishing one member of your support staff is enough in many cases to destroy your reputation and potentially your business in one incident.

No different than in traditional IT departments, accounts that possess privilege should only be used when needed, and they should always require multi-factor authentication. All usage should also be logged and reviewed frequently.

2. Access rights

Should every technician be allowed access to every client? Perhaps, but probably not.

Often, groups of clients, especially key customers, have a dedicated support person or team. No different than how we segment networks to provide audit points and to contain risk, privileges require bounds.

Logging is critical in recognizing unusual access – like off hours use or access to an account assigned to a different team, which can be signs of insider fraud or an external threat actor preparing to launch a ransomware attack.

3. Monitoring for compromise

Monitoring is often under resourced as opposed to prevention. The problem is, we know that prevention isn’t always 100% achievable, yet when it comes to detection and monitoring for the failure of our preventative controls, we are being too reactive. Once an attack becomes obvious it is often too late. By the time a criminal pulls out the ransomware, they have already stolen critical data and, more often than not, have had access to your network for 30 days or more.

During investigations conducted by the Sophos Managed Threat Response team, two things stand out as early indicators of compromise. One is the use of credentials for remote access and administrative purposes during off hours; the other is the abuse of system administration tools in order to conduct surveillance and steal data from the network.

The use of legitimate accounts and your own tools is often referred to as Living Off the Land (LotL). Detecting this requires vigilance and skill. To a trained security operations center analyst, these things stand out clearly and can tip you off to thwart the attack before the bulk of the damage has been done. You either need to invest in training your staff to monitor these behaviors or engage with outside experts to monitor it on your behalf.

Prioritizing Supply Chain Security

Improving on these three important areas will significantly reduce cybersecurity risks, putting MSPs and MSSPs ahead of their competition when it comes to protecting customers.

Prioritizing supply chain security defenses can be a significant competitive advantage for service providers in acquiring new customers – and perhaps most importantly, retaining the ones they already serve.

These are simply starting points where we have identified common points of failure. Security is a journey, and securing the supply chain is just one piece of the bigger puzzle.

The pages slugged ‘Brand Connect’ are equivalent to advertisements and are not written and produced by Forbes India journalists.