2.3 Supply Chain Vulnerabilities

Supply Chain Risk

Refers to the entire process of getting a product from raw materials to the final consumer.

• Involving various steps such as suppliers, manufacturers, distributors, and customers.

From a security perspective, each step in the supply chain is a potential point of vulnerability.

• An attacker can inject malicious code or find other ways to compromise the supply chain

• Because we generally trust suppliers and the products they provide, we often trust the equipment we use without considering potential risks.

• One exploit within any part of the supply chain can infect the entire chain, spreading vulnerabilities across multiple systems or organizations.

Service Providers

While you can control your own security posture, outsourcing security tasks to third-party service providers introduces additional risks.

• The service provider is responsible for managing the security of the systems they operate for you.

• Becomes especially critical if the service provider has access to systems containing sensitive data.

• If an attacker gains access to the service provider’s systems, they could potentially access your sensitive data as well.

• many organizations work with numerous service providers, such as network, utility, cloud services, office cleaning, payrolling/accounting, and system administration providers.

To mitigate these risks, it’s common for organizations to conduct ongoing security audits of their service providers.

• These audits are typically written into the service contract and allow the organization to evaluate and ensure that the service provider’s security measures are adequate

Target Service Provider Attack

One of the most significant credit card breaches in history occurred in November 2013 with Target Corporation, where over 40 million credit card numbers were stolen.

• The breach started with an attack on a service provider: a heating and air conditioning (HVAC) firm in Pennsylvania.

• The HVAC firm was infected with malware delivered through an email.

• The malware enabled attackers to steal VPN credentials for HVAC technicians, who had access to the Target network through their work on the HVAC systems.

• The HVAC network and Target’s cash register network were connected on the same network

• Attackers used this vulnerability to deploy malware on 1,800 Target stores' cash registers.

• For months, the malware collected credit card information from every transaction until it was eventually discovered and removed.

This attack highlights the risk that non-IT service providers can pose. The HVAC technicians, while not directly involved in IT security, inadvertently provided a path for attackers to compromise Target’s network.

Hardware Providers

When it comes to hardware like servers, routers, switches, firewalls, or software, can you really trust the manufacturers and vendors?

• Build trusted relationships with your vendors and use a select group of reliable, vetted vendors instead of purchasing from anyone available online.

• There should be clear policies and procedures in place for acquiring and implementing hardware.

• Any new hardware should be treated as potentially untrusted when first received

  
  

Trust has its limits—while vendors and hardware manufacturers are generally reliable, it’s vital to approach new hardware cautiously,

Cisco or Not Cisco?

All network traffic flows through devices like switches and routers, making these devices prime targets for attackers looking to infiltrate networks and gather sensitive information.

• A notable case in July 2022 involved the Department of Homeland Security (DHS) arresting the CEO of a reseller who sold over $1 billion worth of counterfeit Cisco products.

• The counterfeit products, primarily knock-offs made in China, were sold under various company names, with the reseller operating about 30 different companies to distribute these fake products.

• These counterfeit devices were marketed as authentic Cisco equipment, but they began to fail, with some even catching on fire.

  
  

A cautionary tale about the importance of thoroughly checking and verifying hardware before integrating it into your production systems

Software Providers

Whenever installing or updating software, it's important to question whether you truly trust the update or installation.

• Every software installation inherently challenges our trust.

• A way to help ensure that trust is valid is by checking the digital signature associated with the installation or update file.

• Most operating systems validate this signature during the installation process, and if it doesn't match, you’ll be notified.

• Updates and patches are often automatic, but the security of these updates should always be considered.

• Malicious software could be installed during this automated process if the software is compromised.

Even open source software is not immune to security risks. They can introduce malicious changes that affect the entire software.

SolarWinds Supply Chain Attack:

The Orion software was used by 18,000 customers, including major companies such as Microsoft, Cisco, Intel, and Deloitte, as well as US government agencies like the Pentagon, Homeland Security, State Department, Department of Energy, National Nuclear Security Administration, and the Treasury Department.

• The attackers compromised software updates for Orion in March and June 2020. These updates were intended to upgrade existing installations but were secretly infected with malicious code.

• The compromise went undetected until December 2020.