ENISA report looks at the Threat Landscape for Supply Chain Attacks

Published: Monday, 09 August 2021 07:53

According to a new ENISA report – ‘Threat Landscape for Supply Chain Attacks’, which analysed 24 recent attacks, strong security protection is no longer enough for organizations when attackers have already shifted their attention to suppliers. This is evidenced by the increasing impact of these attacks such as downtime of systems, monetary loss and reputational damage.

According to the report novel protective measures to prevent and respond to potential supply chain attacks in the future while mitigating their impact need to be introduced urgently.

In order to compromise targeted customers, attackers focused on the suppliers’ code in about 66 percent of the incidents analysed. This shows that organizations should focus their efforts on validating third-party code and software before using them to ensure these were not tampered with or manipulated.

For about 58 percent of the supply chain incidents analysed, the customer assets targeted were predominantly customer data, including Personally Identifiable Information (PII) data and intellectual property.

For 66 percent of the supply chain attacks analysed, suppliers did not know, or failed to report on how they were compromised. However, less than 9 percent  of the customers compromised through supply chain attacks did not know how the attacks occurred. This highlights a gap in terms of maturity in cyber security incident reporting between suppliers and end-users.

The report includes an extensive number of recommendations for customers to manage the supply chain cyber security risk and to manage the relationship with suppliers.

Recommendations for customers include:

The report also suggests possible actions to ensure that the development of products and services complies with security practices. Suppliers are advised to implement good practices for vulnerability and patch management for instance.

Recommendations for suppliers include:

Read the report.