Stopping supply chain attacks
Supply chain attacks are increasingly common and increasingly disruptive, but organizations still struggle to defend against them properly. In this episode of the ITPro Podcast, Jane and Ross are joined by Haydn Brooks, CEO of supply chain security firm Risk Ledger, to talk about what threats businesses are facing, what mitigation strategies could work well, and why cyber teams need to work together throughout the supply chain. Highlights "Most of the attacks that you find in in kind of the supply chain main are untargeted. So it's where you've had a threat actor launch a lot of attacks against a lot of different targets, they've breached a company without really knowing who that company is or was, and then they've basically passed that access on to somebody else, or they've gone on and leaked data or taken that company offline. And it's not really like a targeted attack against someone else, it's just that other companies who use that supply ... experience that as a supply chain attack, and very few of them are targeted. Where they are targeted, they are very hard to defend against because essentially, as the end target, I'm having to worry about an attack against somebody else, which I have no control over, being able to detect that and then being able to somehow respond to it as well." "I think actually the regulation has kind of followed the the movement that we've seen within the industry rather than the other way around ... we're seeing a lot of these regulations also requiring companies to be either taking threat intelligence from others or sharing threat intelligence with others, as well as reporting incidents. So all of the regulation and the way security teams operate is moving in that direction of being more open, sharing more to benefit for the wider industry." Links Cyber resilience in the UK: learning to take the punches DORA and why resilience (once again) matters to the board Securing the supply chain: Why zero trust and recovery readiness are non-negotiable Logistics firm supply chain breach hits Valve and other customers Former NCSC head says the Jaguar Land Rover attack was the 'single most financially damaging cyber event ever to hit the UK' as impact laid bare The LiteLLM supply chain attack this year could be the biggest ever Why supply chain resilience is under the spotlight Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attack
