Cyber Resilience – Securing the Supply Chain

The recent electronic pager attacks by Israel against the foreign terrorist group Hezbollah emphasize the need for securing supply chains in today’s increasingly complex geopolitical landscape. These incidents, which resulted in remotely detonated explosives hidden in pager and walkie-talkie batteries, serve as a stark reminder of the vulnerabilities inherent in supply networks, particularly those involving third-party hardware and software. As the risk of supply chain attacks grows, it is crucial for organizations to adopt rigorous supplier validation processes, prioritize secure data exposure, and cultivate a proactive “assumption of breach” mindset.

As outlined in Fundamental 11 of WaterISAC’s 12 Fundamentals | Secure the Supply Chain: “Engaging with third-party vendors expands a utility’s attack surface whereby cyber threats can infiltrate a utility through its supply chain. Likewise, as third parties often have access to sensitive data/information, this necessitates regular assessments of third-party security postures. A supply chain or third-party risk management strategy helps identify and mitigate potential threats and contributes to maintaining operational integrity by reducing the risk of disruption to critical (operational or business) processes due to third parties.” Indeed, a report from earlier this year found that a significant percentage of major U.S. energy companies suffered a cyber incident as a result of third-party vulnerability.

Verizon’s “2024 Data Breach Investigations Report” found that the use of zero-day exploits to initiate breaches surged by 180% year-over-year — and among them, 15% involved a third-party supplier. Given the complexity, scale, and integration of today’s supply chain ecosystems, putting effective supply chain safeguards in place is much easier said than done. By focusing on comprehensive risk management strategies, including stringent access controls and detailed incident response plans, cybersecurity teams can better safeguard critical infrastructure and mitigate the impacts of supply chain threats. For more information, visit Dark Reading.

Additional Resources:

• Choosing Secure and Verifiable Technologies
• Fundamental 11 | Secure the Supply Chain