There seems to be no shortage of ways that business’ emails, computer networks, devices, and operating systems can be attacked.

Software Supply Chain Attacks are growing in popularity as we use more and more custom software to empower our businesses.

To be honest – the best mindset to have is: if it can be attacked, it will be. Just like a retail store having to deal with shrink/theft, businesses need to cultivate the mindset that cyber attacks are a part of today’s business landscape. The bigger the business, the bigger the target.

We believe a proactive approach to protecting your Business IT Computer Systems and Networks is the best place to start. Having the right tools in place to actively monitor, the right people doing that monitoring, and finally strong disaster plans in place to protect your business if disaster strikes is essential risk mitigation practice.

At Britec, we believe that you deserve to be able to operate your business with confidence, and we empathize with the ongoing challenges to keep it secure.

What is a Software Supply Chain Attack?

Simply put, a software supply chain attack is like getting a package delivered with a hidden, dangerous item inside, disguised as a harmless item.

What happens in a software supply chain attack is: An attacker infiltrates the process of delivering software (or code) to a user’s device, adding in malicious code to an otherwise legitimate software program without your knowledge.

This malicious code can then steal sensitive information from other areas of your network, damage or corrupt data, launch other attacks (like ransomware), or use the infected device for malicious purposes.

Here is one example of how this type of attack could be conducted:

1. A junior analyst is tasked with building a new business automation.
2. Using online resources, they find an amazing solution which involves a popular open source code library.
3. That code library is used by many organizations – and is assumed safe.
4. The new automation tool is executed and performs well for the organization – saving time and money.
5. Unbeknownst to everyone was that the open source code had been compromised and silently searches for vulnerability in the business’ network.
6. Months later, an attack is launched, compromising customer data.
7. An investigation reveals what happened, that it was not intentional, but nonetheless damage was done.
8. Steps are then taken to prevent this in the future, but customer data was still lost.
9. The business must now respond in a meaningful way so as to not lose customer trust.

What are the top 3 ways to prevent an attack of your software supply chain?

1. Supply Chain Validation:
   Verify the authenticity and integrity of software and software suppliers before incorporating them into your business systems.
2. Code Signing:
   Use digital signatures to authenticate the source and integrity of software components. This requires technical skills from a strong IT and devops team to ensure that any published code is properly managed.
3. Vulnerability Management:
   Continuously monitor and patch known vulnerabilities in any third-party software components you are using.

Preventing supply chain attacks require technical knowledge of both IT and Cyber Security. If your business leads with strong systems and protective measures in place, those preventative measures will pay dividends.

So the question goes to you:

Who is actively championing this within your organization? If you’re not sure, we strongly suggest having some internal conversations. If you need help, advice, or want to talk more – the Britec team is always here to help. Contact us and we would be happy to have a conversation.

If you are interested in other articles check out Choosing Business Hardware & Computer Systems.