Translated from 日本語 • View original 
Let's first review "connections" to protect our company
Don't you think that we will not be targeted?
The tide of cyber attacks is now steadily shifting from "direct attacks" to "indirect attacks".
As long as you are a business partner of a major company or government agency, you can be a potential "springboard" for attackers. What is a supply chain attack?
A supply chain attack is a method of indirectly attacking by abusing a "relationship of trust" such as a business partner or a contractor.
Attackers do not directly infiltrate the target company, but break through external vendors and affiliates with poor security.
The main routes of invasion are as follows.
- Fraudulent use of accounts from external vendors
- Malware in software updates
- Phishing disguised as an email from a business partner
- Abuse cloud storage sharing settings
In other words, no matter how strong your company's security is, if the "other party you are connected to" is weak, the essence of this attack is that it cannot be defended.
Actual Conditions and Characteristics of Damage
In the 2020 SolarWinds incident, malware embedded in update files in IT management software spread and affected thousands of companies, including U.S. government agencies.
In Japan, there are an increasing number of cases of ransomware infections and information leaks through business partners.
The following two points are distinctive.
- Wide range of damage: One company's infringement is chained to business partners and customers
- Prolonged impact: It takes time to identify the route of infection and restore credibility
Once damage occurs, it is directly linked to not only direct losses but also secondary risks such as trading suspension and brand damage.
3 Challenges Security Professionals Face
- Invisible security status of subcontractors and business partners
Transactions are multi-layered, and it is difficult to grasp the status of measures taken by all partner companies. - Zero Trust is not keeping up
As cloud usage and remote work progress, the premise that "internal = safe" collapses. - Lack of Contract and Governance
The contract does not specify security clauses, and the demarcation of responsibilities is unclear.
🛠️ Measures to Take: Thinking from Three Perspectives
1. Taking stock of "connections"
First, identify how your company and the outside world are connected.
- Visibility into system integrations, VPNs, file sharing, account lending, and more
- Clarify the scope and authority of subcontractors to access
- Remove unnecessary connections and permissions
➡ The first step is to visualize "who, where, and in what range" are connected.
2. Adopting a Zero Trust Model
Let's adopt the design philosophy of "not premised on trust".
Typical measures are as follows.
- Enforce multi-factor authentication (MFA)
- Access control with identity management platform (e.g., Microsoft Entra ID)
- Risk-based authentication with conditional access
- Detection of behavioral anomalies with Defender for Cloud Apps, etc.
➡ The key is to incorporate continuous verification based on the connection source and behavior content as a mechanism.
3. Log Consolidation and Enhanced Monitoring Regime
The idea of "early detection and minimization of damage" is more important than "completely preventing intrusion".
- Consolidate logs for each product and cloud service
- Cross-sectional analysis with SIEMs such as Microsoft Sentinel
- Establish a 24-hour monitoring system in cooperation with the SOC (Security Operation Center)
➡ The key is to detect abnormal access and suspicious communications early and have a system in place to respond quickly.
Design not only to "prevent" damage, but also to "not spread"
It is impossible to completely zero the intrusion.
That's why let's aim for a structure that minimizes damage even if it is invaded.
- Minimize privileges
- Encryption of sensitive data
- Network isolation through segmentation
- Regular verification of backup system
These prevent lateral deployment after intrusion and make it possible to contain damage.
Summary: Toward "relationship security" that does not assume trust
A supply chain attack is an attack that exploits "trust."
However, the business relationship cannot be severed.
The important thing is to "trust and verify".
- Visualization of external connections
- Adopt a Zero Trust model
- Strengthening the monitoring system through log integration
By taking these steps incrementally, you can increase the resilience of your entire supply chain.
Colorkrew Security provides the introduction, operation, and SOC of the SIEM introduced in "Log Integration and Strengthening Monitoring System". Please feel free to contact us.