To protect against Supply Chain Attacks, organizations should secure both their own environment and the third-party software, services, and vendors they rely on.
How to Protect Against Supply Chain Attacks
- Vet Third-Party Vendors
- Assess vendors’ security practices before doing business.
- Require security questionnaires and audits.
- Use Trusted Software Sources
- Download software only from official websites or verified app stores.
- Avoid cracked or unofficial software.
- Verify Digital Signatures
- Ensure software is digitally signed by the legitimate publisher.
- Check file hashes (SHA-256) when available.
- Keep Software Updated
- Regularly install security patches for operating systems, applications, and firmware.
- Implement Least Privilege
- Limit vendor and application permissions to only what they need.
- Remove unused accounts and privileges.
- Monitor Third-Party Access
- Log and review vendor activity.
- Disable access when it is no longer required.
- Use Multi-Factor Authentication (MFA)
- Require MFA for vendors, administrators, and remote access.
- Segment the Network
- Isolate third-party systems from critical business systems.
- Prevent attackers from moving laterally.
- Use Endpoint Detection & Response (EDR)
- Detect suspicious behavior on endpoints.
- Respond quickly to compromised software or devices.
- Maintain a Software Inventory (SBOM)
- Track all software and dependencies.
- Use a Software Bill of Materials (SBOM) to identify affected components when vulnerabilities are disclosed.
- Monitor for Security Advisories
- Subscribe to vendor security bulletins and vulnerability alerts.
- Respond promptly to critical advisories.
- Have an Incident Response Plan
- Prepare procedures for isolating affected systems, notifying stakeholders, and recovering from a supply chain compromise.
Best Practices
- ✔️ Use only trusted vendors.
- ✔️ Verify software authenticity.
- ✔️ Apply updates promptly.
- ✔️ Restrict third-party access.
- ✔️ Monitor vendor activity continuously.
- ✔️ Conduct regular security assessments and audits.
- ✔️ Maintain backups to support recovery after an attack.
These measures help reduce the risk of attacks similar to the SolarWinds, Kaseya, and MOVEit supply chain incidents by limiting trust, increasing visibility, and enabling faster detection and response.