Background: Increasing attacks and difficulty of detection

In recent years, supply chain attacks have become rapidly sophisticated, and the number of attacks is on the rise. In particular, there are many attacks targeting software updates and cloud services, and the diversification of attack vectors is remarkable.
Attackers are more efficient at penetrating through weaker-defending contractors and suppliers rather than directly breaching the target organization's defenses. Therefore, organizations need to assess and monitor the security of not only their own company, but also the entire supply chain.

Attacks are difficult to detect because they don't leave traces of intrusion and damage doesn't surface in the early stages of an attack. When damage is discovered, the impact may be very large because business suspension and information leakage may already be widespread.

 

Attack Techniques and Risks

Supply chain attacks are characterized by the diversity and sophistication of attack vectors. Typical methods include:

• Via software update
  Legitimate updates and patches can contain malicious code. Users are infected simply by performing normal update operations, making it difficult to defend against.
• Via a contractor
  It infiltrates the environment and network of the subcontractor, and from there it is deployed horizontally to the original target. If the contractor's security posture is weak, it is difficult to defend before it reaches the target.
• Tampered libraries and dependencies
  If external libraries or packages used in a development environment are tampered with, simply incorporating them into the application poses a risk. Be careful, especially if you have a lot of open source dependencies.

These techniques pose a wide range of risks, including information breaches, business stoppages, financial losses, and credit damage. In addition, attackers may hide for long periods of time, and damage detection is often delayed.

 

Measures and implementation procedures

An effective defense against supply chain attacks is to manage risk in an integrated manner across the organization. You can build it by following these steps:

1. Account evaluation
   We regularly audit and evaluate the security system of our outsourcing companies and business partners. It's crucial to clarify security requirements during the contract phase and adjust access rights and trading terms based on the assessment results.
2. Network Visibility
   We will visualize the communication routes between the company and business partners, and establish a system that can detect unauthorized access and abnormal communication at an early stage. Even in complex networks such as multi-cloud environments and VPN connections, proper installation of monitoring points is key.
3. Penetration Testing and Audit
   We regularly conduct penetration tests not only in-house but also with our subcontractors to discover potential vulnerabilities. Remediation measures can be implemented based on test results to reduce attack vectors.
4. Anomaly Detection Settings
   We will introduce a system that can automatically detect suspicious communications and signs of tampering. Log analysis and integration with SIEM and EDR can also monitor post-intrusion behavior.
5. regular review
   Regularly review security policies and rules to keep up with the latest threats and changes in your accounts. This allows you to continuously improve your organization's defenses.

 

What it should be

Ideally, the company has a comprehensive understanding of risks inside and outside the organization, and security controls, including those of contractors, are established.
This improves the overall security of the supply chain and allows for early detection and containment of any intrusions. Regular training and simulated attacks can also be expected to raise awareness and speed of response for personnel.

 

Conclusion

Supply chain attacks cannot be prevented by single defenses.
The most effective approach is to combine account assessment, network monitoring, penetration testing, anomaly detection, and periodic reviews to manage risk across the organization.
As attack techniques continue to become more sophisticated, it's crucial to incorporate defenses that align with the latest trends and ensure the security of the entire supply chain.