Product Security Glossary

Supply Chain Security Solutions

What are Supply Chain Security Solutions? 

Supply chain security solutions are the principles, practices, and policies that a business would use to protect itself from a supply chain attack. 

What is a Supply Chain Attack? 

A supply chain attack, sometimes known as a software supply chain attack, happens when bad actors attack the developers or suppliers of business software.  The goal is to distribute malicious code by injecting it into the source code, the build process, or the update mechanisms for that software.  This type of attack allows bad actors to break into a business network that might have strong defenses by going through a vendor with whom the business has ties.  The vendor will typically have weaker security than the business that the bad actors really want to attack.  Proper supply chain security solutions can help prevent these types of attacks from being successful. 

Supply chain attacks can be physical, such as when a submarine sinks a container ship that belongs to another country.  For our purposes, we’ll only discuss the cybersecurity aspect of supply chain security solutions. 

How Can Supply Chain Security Solutions Help? 

Implementing proper supply chain security solutions can help prevent attackers from injecting malicious code into business software.  This will help prevent attackers from stealing sensitive data, interrupting the production process, or interrupting the delivery of finished goods.  Preventing these types of incidents will not only save the business a lot of money, it will also help the business retain the trust of its customers. 

What Are Some Supply Chain Security Solutions? 

The first responsibility lies with the developers and vendors of business software.  They need to implement proper network security, and continuously monitor the network to ensure that it remains secure.  Having a proper secure software development lifecycle will help ensure that security problems don’t get inserted into the software. 

Integrators, enterprises and OEM that receive code from multiple parties need to be on alert for malicious activity in the upstream of the supply chain. They need to implement a series of tests to vet incoming software components to detect any malicious addition. Preferably, such tests will be automated, which will allow quick integration of 3rd part software components, while detecting supply chain attacks swiftly.  

Businesses that use the software also have a responsibility.  The business should perform vulnerability assessments and penetration testing on its systems in order to find things such as bad passwords or misconfigured databases that may be added as part of a supply chain attack. They also need mechanisms to detect suspicious activity on the network, just in case they do end up using a vulnerable piece of software.  All data need to be properly classified and stored in a secure manner, using proper encryption methods.   

Many times, security breaches come through a vendor with whom a business buys services or products.  The business should have close ties with the security teams of all its vendors, to ensure that the vendors’ access to the business network doesn’t cause any security breaches. 

In cases where all else fails and a security breach does happen, businesses need to have a properly trained Incident Response team standing by, at the ready.  This team will take proper measures to stop the attack, assess the damage, perform proper investigations, and place the network back in a secure operating mode.  The team will then write its reports in a lessons-learned format and discuss it with company management. 

As you can see, supply chain security solutions are very important, and every business should understand how to implement them.