Most supply chain attacks target supplier’s code—ENISA

Cybersecurity experts have long been concerned about supply chain attacks because a single attack can wreak havoc and compromise a network of providers.

According to the European Union Agency for Cybersecurity’s (ENISA) Threat Landscape for Supply Chain Attacks, 62% of supply chain attacks use malware as a technique. The report also mentioned that strong security protection is no longer adequate for enterprises when attackers have already targeted suppliers.

The report examined 24 supply chain attacks documented from January 2020 to early 2021. About 50% of the attacks were attributed to well-known Advanced Persistent Threat (APT) groups by the security community. 

Moreover, an estimated 42% of the analyzed attacks haven’t been attributed to any group.

In 62% of the cases, the attacks on customers took advantage of their trust in the supplier, with 58% of the attacks aimed at getting access to data, including personal data and intellectual property.

Based on the trends and patterns observed detailed in the document, supply chains have increased in both number and sophistication in 2020. ENISA said that this trend is continuing in 2021, increasing the risk for organizations.

Half of the identified attacks were attributed by APT actors with increased resources and sophistication, requiring new protective methods that incorporate suppliers to ensure that enterprises remain secure.

“Due to the cascading effect of supply chain attacks, threat actors can cause widespread damage affecting businesses and their customers all at once. With good practices and coordinated actions at (the) EU level, Member States will be able to reach a similar level of capabilities raising the common level of cybersecurity in the EU,” said Juhan Lepassaar, EU Agency for Cybersecurity Executive Director.

The agency also recommended customers identify and document suppliers and service providers, define risk criteria for various suppliers, and monitor supply chain risks and threats.

For suppliers, it is recommended to ensure that their infrastructure follows cybersecurity practices, monitor vulnerabilities, and maintain an inventory of assets, including patch-relevant information.

It is also vital for both enterprises and suppliers to gain a better understanding of overlooked threat vectors that could shut down their operation if not contained.

Trend Micro’s proof-of-concept paper, Forward-Looking Security Analysis Of Smart Factories, identified various overlooked entry points that attackers could access. 

These include manufacturing execution systems (MES) and engineering workstation (EWS)—systems that are indispensable in smart manufacturing.

Enterprise decision-makers must always be up-to-date with the latest trends in supply chain and cybersecurity to future-proof their organizations’ operations, minimizing the threat of more sophisticated attacks that could destroy their entire ecosystem.

To learn more about supply chain security and best practices, check out these forward-looking resources brought to you by Trend Micro:

Read More HERE