Supply Chain Cyberattacks on the Rise: What Your SMB Needs to Know

What is a supply chain attack? 

A supply chain attack is a specific type of cyberattack that impacts both a third-party vendor and a customer. These attacks have historically targeted organizations in trusted partnerships, such as when cybercriminals targeted Target’s HVAC contractor as the first step in the 2013 Target breach. After attackers circumvented the HVAC contractor’s poor security, they were able to gain access to Target’s systems on a shared network.

Today, though, the supply chain threat comes in the form of attacks against the software supply chain, which includes all the cloud-based software and services a business relies on for its operations. In attacks such as these, attackers manage to insert malicious code into one of the many third-party components developers frequently use in their applications, such as APIs or open source code. This could then lead to the application becoming unintentionally malicious or having a back door, which would allow attackers to target anyone who installs the compromised app.

Why are supply chain attacks on the rise?

The proliferation of services, vendors and third-parties has done wonders for company efficiency and budgets. The growth of software-as-a-service (SaaS) offerings and the widespread adoption of cloud hosting have allowed employees to work efficiently from anywhere, while the growth of worldwide supply chains has allowed businesses to source materials and support functions at competitive prices from a global supply. Companies can even outsource their IT and security management to managed service providers (MSPs) to save overhead costs and cut headcount. 

While these third-party services save companies time and money, they can lead to cybersecurity risks. Cybercriminals looking to maximize the scope of their attacks have increasingly targeted third-party vendors with the hopes of using them as a stepping stone to target thousands of downstream clients in supply chain attacks, according to NTT Security Holdings’ 2022 Global Threat Intelligence Report. These types of supply chain attacks are likely to grow in popularity, according to the report, as cybercriminals copy and learn from each other. 

How can supply chain attacks affect SMBs?

A successful supply chain attack can have numerous repercussions for both the vendor and any targeted customers. However, the ultimate damage of a supply chain attack depends upon the goal of the attacker. In the case of the 2013 Target breach, attackers used the HVAC company as a stepping-stone to breach Target and steal the financial and personal information of upwards of 100 million Target customers. [Has your business been attacked? Learn how to mitigate the damage of a small business data breach.]

While the Target attack was a pure case of data theft impacting a single end company, attackers can also use supply chain attacks for other purposes, such as distributing ransomware. In July 2021, attackers compromised servers belonging to Kaseya, a supplier of software services and tools to MSPs. By compromising Kaseya, the attackers were then able to compromise the MSPs, ultimately using the MSPs to deliver ransomware to the end clients. Altogether, this attack compromised an estimated 1,500 MSP clients. 

Both of the above attacks are examples of attackers taking advantage of a trusted relationship between a vendor and a client. According to CrowdStrike, though, the larger threat to businesses comes in the form of software supply chain attacks. These attacks are particularly concerning, as the average software project has 203 dependencies on outside code. This means that if one popular application or vendor uses one malicious software dependency, it could lead to that application’s being compromised. This, in turn, could make every business relying on that application or vendor vulnerable to a data breach.

As popular third-party software packages may be used in a wide range of applications, a successful compromise of a package could result in attackers being able to compromise a large swath of businesses through their software tools.

Software supply chain attacks are likely to become a greater concern in the coming years. According to CrowdStrike’s 2021 Global Security Attitude Survey, 84% of surveyed respondents believed that these types of supply chain attacks could become one of the most serious cyber threats to businesses within three years. This risk is further compounded, as 59% of the businesses surveyed that suffered a supply chain attack did not have a response strategy in place at the time of the attack. 

While supply chain attacks are concerning, it is important for businesses to remember that the ultimate impact of a supply chain attack is the same as if cybercriminals targeted a business directly. The difference is the manner in which cybercriminals target a business in the first place. 

While businesses cannot directly control the security of their vendors, there are a number of steps they can take to help avoid falling victim to a supply chain attack. We’ve put together the following primer to explain exactly what supply chain attacks are and how businesses can defend against them. 

How can I prevent supply chain attacks?

Supply chain attacks can be difficult to prevent as well as to detect, as they exploit the trust businesses place in their suppliers. Fortunately, there are still steps that businesses can take to either prevent a supply chain attack or mitigate the impact of one. [Related article: How to Improve Your Small Business’s Cybersecurity in an Hour] 

• Rigorously assess vendors. Before partnering with a vendor or using any third-party tools or software, businesses should rigorously check a supplier’s security measures. This includes researching any breaches the vendor may have experienced in the past as well as asking the vendor to detail their own security practices.
• Use a zero-trust model. Whenever possible, businesses should ask their IT department to employ a zero-trust model. This assumes that no user or application should be trusted by default, limiting the types of activities possible within a network.
• Use security tools. Security tools like firewalls and antivirus products won’t necessarily block a supply chain attack. However, they may be able to alert you when an attack is taking place. For example, firewalls may be able to detect and block large amounts of data leaving a network, indicating a breach, while antivirus software can recognize ransomware or other malware.
• Come up with an incident response plan. Businesses should prepare for possible compromise ahead of time and have a response plan ready. This plan should include identifying mission-critical business components, clearly delineating roles for incident response and implementing a communication strategy for letting customers and partners know about a breach.
• Prepare with your IT team. Whether you use an MSP or have an in-house IT team, your business should prepare for a potential supply chain attack with the IT team. This planning should involve working through the incident response plan on a regular basis. Additionally, the U.S. Department of Commerce’s National Institute of Standards and Technology has released guidance on defending against supply chain attacks.

What is the future of supply chain attacks? 

Supply chain attacks are likely to be an increasingly common fact of life for businesses in the future. NTT Security Holdings predicts that the success of high-profile supply chain attacks over the past two years, including the SolarWinds attack that impacted an estimated 18,000 clients, will likely inspire other copycat incidents. The threat of software supply chain attacks will also continue to grow. The best way to protect yourself against the growing threat of supply chain attacks is to prepare today by devising cybersecurity procedures and establishing incident response plans that enable you to act quickly if a supply chain attack were to impact your business.