In this lesson,
we're going to discuss supply chain attacks.
As our globalized and digitized world
brings about more interconnectivity,
our supply chains grow even more dense and intertwined
which can expand the attack service of our network
that malicious actors are trying to exploit.
So let's take a look
at what a supply chain attack actually is,
some real world examples of supply chain attacks,
and how these attacks could have been mitigated.
Now, to begin, let's talk about a supply chain attack
and what it actually is.
Simply put, a supply chain attack
is an attack that involves targeting
a weaker link in the supply chain
to gain access to a primary target.
So instead of attacking a well fortified entity directly,
your adversaries may attempt to exploit vulnerabilities
inside of their suppliers and service providers
to pave their way into the organization's larger
and otherwise more secure systems.
Now, supply chain attacks have been happening
for many, many years.
Throughout the 2000s and 2010s,
Cisco routers and switches
were often the source of supply chain attacks
that focused on selling counterfeit devices
out on the secondary market.
Basically, a counterfeiter would take an old Cisco chip,
and then conduct something known as chip washing.
Now, chip washing involves
repackaging the contents of a microchip
with a less expensive one
or one that contains embedded malware.
In the best case,
your organization just bought a router or a switch
that isn't going to work right
and it's going to lead to some network failures or crashes.
At worst, you just installed a router
or switch that you thought you could trust
but it actually has a counterfeit chip inside of it
that contains malicious functionalities
that turns your own network hardware against you
and provides an always-on backdoor
into your network for a given threat actor.
Now, another worrying trend is the deliberate embedding
of root kits within devices by your overseas suppliers.
These pre-installed malware tools
can provide backdoor access to networks
once the devices are active.
Given that a significant portion
of our tech manufacturing happens overseas
and outside of the United States,
this poses an enormous risk for our US-based companies
and governments alike.
This is another reason
why conducting a good vendor assessment is important
when you're determining which types of hardware,
software, and service providers
you're going to use inside of your organization.
Now, in addition to these hardware-based attacks,
we also have software-based supply chain attacks
that we need to think about.
Back in 2021, one of the largest
software-based supply chain attacks
that we've observed was seen
and this involved the network monitoring
and management software known as SolarWinds.
During the attack,
cyber criminals infiltrated
the SolarWinds Orion software update system
and used it to distribute their own malware
to all of the company's wide range of clients
including city, state,
and national governments across the world.
The attacker's goal here
wasn't to infiltrate a single target,
but instead they want to compromise the networks
of thousands of organizations
including various US government agencies.
This incident was a really big wake up call
for many organizations
and it illustrates the indirect avenues
that attackers could employ
to bypass even the most robust security defenses
like those that are used by the Department of Defense.
Now, recognizing that supply chain risk
can quickly turn into a supply chain attack,
the US government passed a new piece of legislation
back in 2022 called the CHIPS Act.
Now, the CHIPS Act,
also known as the Chips and Science Act of 2022,
is a US federal statute
that provides roughly $280 billion in new funding
in order to boost research
and manufacturing of semiconductors
within the borders of the United States.
This act includes $39 billion in subsidies
for chip manufacturing on US soil,
along with a 25% investment tax credit
for cost associated with manufacturing equipment,
and another $13 billion
for semiconductor research and workforce training.
The CHIPS Act was designed to minimize supply chain risk
by reducing the United States' reliance
on foreign made semiconductors.
Semiconductors are essential components
in a wide range of products
from smartphones and cars
to medical devices and defense systems
like missile systems and airplanes.
The global semiconductor supply chain
is really complex and interconnected,
and disruptions to the supply chain
can have significant economic and security implications.
This is one of the reasons the CHIPS Act was designed.
It was there to help strengthen
the domestic semiconductor supply chain
and make it more resilient to disruptions.
By investing in our domestic manufacturing
and research capabilities,
the CHIPS Act is going to help ensure the United States
has a reliable supply of semiconductors to meet its needs
and will help to minimize supply chain risks,
create jobs, and boost the US economy overall.
So I told you about the problems with the supply chain
and some of the things that the government
is doing to step in and help,
but what can you and your organization do
to safeguard yourself against supply chain attacks?
Well, it really comes down to four things:
vendor due diligence, regular monitoring and audits,
education and collaboration,
and incorporating contractual safeguards.
First, we have vendor due diligence.
Organizations must practice rigorous due diligence
when onboarding their vendors,
especially those with access to critical systems or data.
This involves not only understanding
the vendor cybersecurity posture,
but also their own supply chain management
and security practices.
Second, we have regular monitoring and audits.
Continuous monitoring and periodic audits
of your supply chain
are considered to be essential.
This will help you have an early detection mechanism
for any suspicious activities or vulnerabilities
that may be exploited by an attacker.
Third, we have education and collaboration.
By keeping the broader ecosystem
informed about the latest security threats,
vulnerabilities and best practices,
we can ensure that our industry, as a whole,
remains better protected.
Collaborating with other organizations and industry groups
can really provide you with a more holistic view
and a joint defense strategy
against these kinds of supply chain attacks and threats.
Fourth and finally,
we have incorporating contractual safeguards.
Now, when engaging with suppliers or service providers,
you're going to use a contract
and that contract shouldn't beg clauses
related to cybersecurity within them.
This type of contract language can help to ensure
that vendors adhere to stipulated security standards
and that there are legal repercussions
if they don't meet your standards or requirements
as outlined inside of that contract.
So remember, in the expanding web of global supply chains,
we are exposing our organizations
to a host of new challenges every single day.
In today's world,
a single vulnerability
in a seemingly insignificant component
could have massive ripple effects,
causing worldwide disruptions on a massive scale.
Therefore, securing our supply chains
isn't just about the information technology
or cybersecurity department anymore.
It really is everyone's business inside of our organization
because it is at the heart
of our very survival and integrity
of our organizations and our nations.