Supply Chain Security 101: Reduce Risk to Your Manufacturing Business

What is Supply Chain Security?

Your organisation has never been more reliant on supply chains to deliver products and services to your end users. Whether it’s ERP software, outsourcing functions like finance or marketing, or working with algorithm and data providers, your supply chain is critical to your manufacturing business’ ability to remain operational and deliver high quality products.

Hackers know this, and will actively target organisations in your supply chain in order to disrupt your operations and gain a foothold into your environment. And even if they don’t target you through your supply chain, any disruptions to your suppliers resulting from a cyber-attack can cause significant collateral damage to you as a result.

You may well work with suppliers that integrate with and have access to you network. Pay special attention to these suppliers, as any compromises they suffer can project directly into your network and act as a launchpad for ransomware and business email compromise (BEC) attacks.

A BEC attack is, broadly speaking, a type of phishing email. What makes it so dangerous is its targeting and sophistication. BEC attacks are most commonly targeted at individuals responsible for handling money within organisations, and through carefully thought out methods their aim is to trick the individual into transferring money to an offshore bank account.

BEC attacks require diligence to address, as they often use sophisticated social engineering to convince victims to part with their money. Part of your supply chain considerations should include diligence around suppliers you make payments to, ensuring processes are in place to double- and triple-check that every payment made is legitimate.

Supply Chain Security Principles

The National Cyber Security Centre (NCSC) has proposed a series of 12 principles, designed to help you establish effective control and oversight of your supply chain. You can learn more about these principles by following the link above, but in summary the principles are:

1. Understand what needs to be protected and why
2. Know who your suppliers are and build an understanding of what their security looks like
3. Understand the security risk posed by your supply chain
4. Communicate your view of security needs to your suppliers
5. Set and communicate minimum security requirements for your suppliers
6. Build security considerations into your contracting processes and require that your suppliers do the same
7. Meet your own security responsibilities as a supplier and consumer
8. Raise awareness of security within your supply chain
9. Provide support for security incidents
10. Build assurance activities into your supply chain management
11. Encourage the continuous improvement of security within your supply chain
12. Build trust with suppliers

By following these best practice principles, you will minimise the supply chain security risks you face. But what questions should you be asking to build an understanding of your organisation’s security posture, along with the security posture of your clients?