Securing digital supply chains

Work with your suppliers to enhance security and quality

People may recall a disquieting episode from 1982 where seven people were adversely affected when they consumed tampered with Tylenol capsules. It was known as the Chicago Tylenol scare, and the perpetrator was never identified.¹

Chicago police launched a major investigation, while the manufacturer – Johnson & Johnson – immediately recalled 31 million bottles from across the US. This prompt action uncovered a number of tainted capsules in other stores across Chicago, almost certainly saving several lives.

In the aftermath of this highly publicised event, safer and better processes and product standards were introduced, including caplets and tamper-evident packaging. Johnson & Johnson’s swift actions enabled it to restore trust in their product, and the episode came to be regarded as textbook example of corporate best practices.

As a Johnson & Johnson spokesperson later summarised:

“We concluded we were never going to be judged by what caused the problem… We were always going to be judged on how we responded to it.” ²

Digital health supply chain attacks

Cyber-attacks on digital health supply chains are like a modern digital equivalent of the Tylenol contamination scare. A product or service that you rely on may one day contain a kind of “poison pill” that can cause havoc on your business and the customers you serve.  

In the digital world, as in the real world, a supply chain attack involves an attack on both a supplier and the supplier’s customers. This occurs by compromising the digital products or services used by customers, such as exploiting any ICT or managed service provider which has trusted access to its customer’s network. Effectively, the customer continues to trust their supplier not knowing that the trust relationship has been broken.   

Access points to the customer’s network can be through many types of ICT platforms, via a supplier’s cloud file sharing appliances, network monitoring tools, clinical information software, a cloud (Software as a Service) accounting application, or any cloud hosted applications or infrastructure.³

These attacks can have a wide and cascading effect, impacting not just a particular business, but that business’s customers, their customers’ customers, and so on.

“Supply chain attacks are now expected to multiply by 4 in 2021 compared to last year.” ⁴

Special mention should be made of “software supply chain attacks” that inject malicious code into third party software products to access the systems and data of the organisations using those products.⁵ The recent SolarWinds attack was a digital supply chain security wake-up call, where it has been reported up to 17,000 SolarWinds customers received the malicious code and hundreds were then further exploited with theft of sensitive information.⁶

A balanced approach to understanding these attacks and their mitigations is essential:

• The main defence against supply chain attacks is to develop a very clear understanding of your supply chain. (More about this below.) This may represent additional work for most organisations, but the resulting clarity about supplier relationships may have additional benefits in assuring the quality of your organisation’s products or services.
• Set up agreements with suppliers that highlight the need to provide visibility of cyber security maturity through assurance (like certification) by stipulating what you’d like to know in formal agreements; these include alerting customers of cyber incidents in order to better manage their impact and reach.
• Meet regularly with key suppliers to assess their performance and talk about any security concerns.
• As these revised business practices become more widespread, suppliers would likely proactively use their security as marketable “cyber security health check” marks, to assure customers of the safety and quality of the associated products and services. The Australian government is presently exploring a scheme of this nature.⁷  

With supply chain attacks on the rise, Australian suppliers of software and digital products and services should consider how they can provide independent and verifiable assurance to their customers. This may incorporate implemented standards or effective cyber security controls and practices including notifying their customers of incidents and vulnerabilities in a timely manner, to help prevent a cascading supply chain event.

How to defend against supply chain attacks

The Australian Cyber Security Centre, advises the fundamental defence against supply chain attacks is to get to know your suppliers better; understand who they are, review their security posture, recognise the potential risks their products and services may present to your organisation, and regularly check the integrity of their development and production processes.⁸

A key part of this process will be to adopt a shared responsibility model with your suppliers.⁹

Regular risk assessments will be another key part of this process. These assessments should:

• Prioritise critical business processes that rely on ICT products or services;
• Be supported by monitoring and follow-up audits to confirm risk mitigation and improvements in processes; and
• Include tested incident response plans covering the scenario of a compromised third-party supplier.

In addition to the above, consider implementing a zero trust architecture if you haven’t already. The fundamental premise of zero trust (that any asset should be considered “untrusted” by default), is in principle ideal for mitigating many kinds of cyber-attacks, including those that target digital supply chains.¹⁰

Find out more

Detailed, actionable advice on managing the risks of digital supply chains is available from:

• The Australian Cyber Security Centre; and
• The Cybersecurity & Infrastructure Security Agency (US)

Comprehensive, up to date overviews of supply chain attacks and their management are available from:

• The National Institute of Standards and Technology (US), and
• The European Union Agency for Cybersecurity.