Sony Pixel Power calrec Sony

Cyber Month: Thursday Thoughts with Thijs: Supply-chain attack

06/10/2022

All businesses have suppliers, fact. But have you ever considered the associated risk of a cyber-attack to your suppliers? Commonly known as either a supply chain attack or third-party risk.

My first musing of Cyber Security Month: what can you do to minimise the risk of a supply-chain attack?

Firstly, what do I mean by a supply chain-attack? Well, these attacks aren't carried out directly on a business, but on its suppliers, such as the Kaseya ransomware attack in 2021. Kaseya offers software that allows companies to manage other companies' IT infrastructure. To use this software, there must be a trusted connection between the vendor and the environment. However, unfortunately there was a flaw in the software that was then exploited by criminals - they only needed to launch their attack on one company in order to gain access to many others to conduct their criminal activities.

How can you minimise this risk?

Keep a register of all your suppliers. Look at the suppliers who have direct (and indirect) access to your environment. Often, access is requested by default due to convenience, either by a direct (continuous) connection or software used to achieve remote access (indirect connection). It's important to know who manages that connection and what software is used to provide remote assistance, as well as creating an overview and monitoring this in your list of suppliers.

Understandably, sometimes it isn't always feasible check in detail if your suppliers have everything in order with regards to information security. So, to try and combat this, I would highly recommend verifying that the supplier has a valid ISO/IEC 27001 certificate and check their statement of applicability.

For your most critical processes and components, you must meticulously go through your agreements with your suppliers - not only those with access agreements - and consider:

Is there a service level agreement (SLA) in place?

What action/reaction can you count on in case of an incident?

Which other suppliers does your supplier use?

Are there any suppliers that may pose a potential risk? For example, can the supplier still guarantee its services to you if one of their suppliers fail?

Another important aspect of supply chain security is checking whether a processor agreement is needed or not - if you need a hand with this, turn to your local Data Protection Authority (DPA) for guidance. If you do need one, make sure that you carefully read the agreement and check, for example, which sub-processors are already known. Don't forget to regularly check and review your agreements, at least on an annual basis, as nothing changes as quickly as the cyber security landscape.

Finally, it strikes me that outsourcing services or tasks to third parties has become commonplace. Most likely due to having to organise and source everything that makes a business run, things such as equipment, software and knowledge in-house, which can be quite expensive. It is therefore absolutely imperative, if you are involving third parties, to be well aware of who is outsourcing what. Outsourcing services does not absolve you of responsibility.

So, to recap my Thursday Thoughts regarding supply-chain attacks:

Keep a register of all your suppliers

Check at least for valid ISO/IEC 27001 certificates

Carefully go through your established agreements with your suppliers

Review your agreements on annual basis

Need some help going through the agreements with your suppliers in the field of information security? Resillion is more than happy to assist you. Contact us for more information.

lang: en_GB

Our Accreditations and Certifications
LINK: https://www.resillion.com/cyber-month-thursday-thoughts-with-thijs-sup...
See more stories from eurofins

More from Eurofins

04/10/2023

Strengthening Your Digital Barriers: The Vital Importance of Regular Pen Testing and Vulnerability Scanning

In today's digital landscape, where businesses rely heavily on technology to...

19/09/2023

Resillion: Supporting Energy Digitalisation

The global energy industry faces immense challenges: Net Zero targets are driving many types of energy consumption to electricity at the point of use instead o...

29/08/2023

Resillion to Serve as Exclusive CI Plus 2.0 Test Partner

As of May 2023 - Eurofins Digital Testing has changed its name to Resillion UK Limited, this name change has been reflected below in the press release from 2019...

25/08/2023

The legend of Tom, Dick or Harriet: a tale of physical security and social engineering

The following is based on real events; names and other details have been changed...

25/08/2023

DPIA - the scary elephant in the data protection room

Data Protection Impact Assessment, or DPIA for short. Even the acronym can strike fear into the hearts of those struggling with data protection compliance. But ...

22/08/2023

CPE and Home Gateway testing: what is it and what are the challenges?

High data rates for residential users have always been hindered by the last-mile bottleneck, i.e., low data rates on the last mile of the access network towar...

22/08/2023

Why you don't call your insurance provider when your house is up in flames

Your house is on fire what do you do first? You wouldn't call your insurance company to let them know your house was ablaze whilst watching the flames furt...

07/08/2023

US government launches cyber security labelling scheme for smart devices

On July 18th, 2023, the US Government announced a cybersecurity certification and labelling program for connected devices. This US Cyber Trust Mark will allow...

31/07/2023

How to implement automation when developing tests in parallel with development sprints

by Dan Martland, Technical Testing Director As we undertake many test automati...

31/07/2023

A guide to the new NIS directive (NIS2)

We previously released some guidance around the new Network and Information Security Directive (NIS2), which you can read here. NIS2 has many different areas to...

25/07/2023

Goodbye 90's QA Health Check Hello Optimisation

By Rich Mort In a past life, some years back, I attended a sales call as a Test Consultant with a fresh faced new go gettem' salesman who was determined t...

20/07/2023

Escalating privileges in Citrix ADC

Part of Citrix's solution line-up, Citrix ADC (formerly NetScaler ADC) is an application delivery and load balancing solution. In March 2023, two of Resill...

17/07/2023

Debunking the myths around Test Automation and how to supercharge your Digital Transformation Programme

Recently, Resillion ran a webinar exploring the myths (or misconceptions) around...

14/07/2023

A Look Behind the Scenes of an Intern Jonas Claes

Hello everyone, my name is Jonas Claes, a 21-year-old coffee enthusiast and software aficionado from Belgium. I'm currently pursuing a degree in computer sc...

03/07/2023

Exciting times ahead for Qi 2.0 and Ki

By Glenn Koninckx, Technical Sales Another face-to-face edition of the Wireless Power Consortium (WPC), this time in the beautiful city of Copenhagen, Denmark...

16/06/2023

NIST Consumer IoT Cybersecurity Labelling

NIST - the US National Institute of Standards and Technology has been examining labelling schemes for the cyber security of Consumer IoT products. Learn more ab...

13/06/2023

QA - Can it really drive Digital Transformation Success?

Recently Resillion ran a webinar with two of our Digital Transformation experts discussing how QA can drive digital transformation success. Although this works ...

09/06/2023

Four takeaways from the OpenADR++ Users Conference Europe

by Bill Chard Resillion was pleased to sponsor and attend the OpenADR Alliance's User Conference Europe, held in London on June 6th and 7th. Over two full d...

31/05/2023

Scaling into infinity part II

In the first part of this series, I started looking at the key components of performance when building and scaling large cloud estates. Now, I'd like to del...

30/05/2023

Interoperable Demand Side Response

Over the Winter of 2022/23, a series of significant events in the UK's electricity supply network featured in the national news. Run by the Electricity Syst...

25/05/2023

Cyber Security vs Incident Response

Your house is on fire what do you do first? You wouldn't call your insurance company to let them know your house was ablaze whilst watching the flames fur...

10/05/2023

Scaling into infinity Part I

The digital revolution has brought myriad exceptional benefits, but the one I'd like to focus on is the unifying force of shared common services; the idea t...

30/04/2023

Nulmeting en terugkerende pentesten: cruciaal voor de beveiliging van jouw organisatie.

Tegenwoordig is het geen vraag meer of je wordt getroffen door een cyberaanval, ...

11/04/2023

NIS2 what's new?

The NIS, originally adopted in 2017, has already put certain measures on the table to improve the cybersecurity of European companies that are considered critic...

16/03/2023

Matter: the new standard for Connected Home Devices

Resillion is an enthusiastic supporter of Matter, the industry-unifying standard for Connected Things, and the Certification Scheme that will underpin its succe...

04/02/2023

Navigeren in de wereld van penetratietesten: De voordelen van het CCV-keurmerk

Er zijn vele aanbieders van pentesten en onderwerpen als ethical hacking en cybersecurity in het algemeen zijn onderdeel van diverse (hogere) beroepsopleidingen...

24/01/2023

Consortium led by Resillion wins Demand Side Response testing project in the UK

Resillion announced a new project funded by the UK Department of Business, Energy and Industrial Strategy (BEIS), focused on the performance testing of Demand S...

09/01/2023

Resillion: a new name and a company with a passion for making IoT work.

London, 9 January 2023: We are pleased to announce the launch of our new company, Resillion. Combining the best-in-class expertise across Digital Testing, Cyber...

08/01/2023

Data Privacy Matters good practices by Gert-Jan

Once again, on 28th January, it is Data Protection Day - hasn't it come round fast! This was originally created by the EU back in 2007 to raise awareness of...

12/12/2022

Hacker delivers households Christmas cards via printer (NL)

Den Haag, 13 december 2022 - In 2021 waren bijna 2,5 miljoen Nederlanders slachtoffer van online criminaliteit.* Via slecht beveiligde slimme apparaten kunnen h...

08/12/2022

Hacker delivers households Christmas cards via printer (Eng)

The Hague, 13 December 2022 - In 2021, nearly 2.5 million Dutch people were victims of online crime.* Using poorly secured smart devices, hackers can penetrate ...

17/11/2022

Resillion achieves CREST SOC accredited status

Commissum is proud to announce that it has been CREST accredited for Security Operations Centre (SOC) services, further strengthening its current CREST accredit...

27/10/2022

Cyber Month: Thursday Thoughts with Thijs: phishing & ransomware

Cyber Month is coming to an end, hasn't it absolutely flown by! During this 10th anniversary of cyber month, a plethora of activities have taken place acros...

20/10/2022

Cyber Month: Thursday Thoughts with Thijs: account management

It's already the third week of this cybersecurity month . Time flies when you're having fun! That means it is also time for my third musing. During C...

13/10/2022

Cyber Month: Thursday Thoughts with Thijs: Awareness

Just because you don't immediately think of it, or can't physically see it, doesn't mean it doesn't exist - out of sight, out of mind' is a...

07/10/2022

Resillion supports the launch of Matter 1.0 and offers Certification Testing

The Connectivity Standards Alliance has this month released the Matter 1.0 standard, and a new certification program for products that connect with Matter. Sma...

06/10/2022

Cyber Month: Thursday Thoughts with Thijs: Supply-chain attack

All businesses have suppliers, fact. But have you ever considered the associated risk of a cyber-attack to your suppliers? Commonly known as either a supply cha...

04/10/2022

Ensuring smooth TV content globally

For World Testers Day, 9th September, we sat down with Programme Manager, Peter Shorrock, of our devices practice, to discuss how we make a difference in the br...

09/09/2022

International Testers Day - finding testers in times of shortages

Richard Mort, a senior consultant at independent Quality Assurance, (QA), testing and cyber security for software systems and devices company, Resillion, here e...

25/07/2022

Why is the NEXTGEN TV Logo critical to the success of ATSC 3.0 deployments in developing countries?

Dr Bob Campbell recently wrote an article about the importance of ATSC 3.0 deplo...

22/07/2022

Virtual Security Officer

When asked about my job at - say - at a birthday party, or other social event and I tell them, people pause for a few seconds, then, usually with a puzzled expr...

18/07/2022

Resillion chosen by the Connectivity Standards Alliance to host Europe's first Matter Specification Validation Event

Resillion is partnering with the Connectivity Standards Alliance (CSA), to exten...

07/07/2022

NextGen TV Logo New Updates

Resillion, in partnership with the Consumer Technology Association (CTA) and National Association of Broadcasters (NAB), is pleased to announce the release of ...

09/05/2022

Virtual Security Officer Need to Know

Protecting your organisation from outsider threat should be of utmost importance - effective cyber security measures keep both your data and systems safe and en...

07/04/2022

Is Basic Authentication too basic?

With various authentication methods available, which exactly is the best? We delve into authentication, authorisation and discuss whether Basic Auth really is j...

06/03/2022

Protected: Resillion Matter 1.2 Specification Validation Event

This content is password protected. To view it please enter your password below: Password: lang: en_GB Our Accreditations and Certifications...

12/10/2021

Eurofins and WiSA Association partner on Soundsend'

Eurofins are pleased to be working with WiSA , the Wireless Speaker and Audio Association to offer state-of-the-art testing for their award-winning SoundSend ...

27/08/2021

Behind the scenes of an Automation Engineer

Hi! My name is Kevin Vissers and I've been working at Eurofins for six years, of which the last three years as Automation Engineer at one of our clients, KB...

19/08/2021

Behind the scenes of a Senior Test Consultant (UK)

Hi! I am Andrew Taylor, Senior Test Consultant at Eurofins Digital Testing (UK). My first proper' job was as a trainee COBOL Programmer for a major Govern...