Protecting supply chains: The recipe against ransomware

With this uptick in ransomware attacks targeting supply chains, organizations must implement stronger, layered security strategies to protect against lurking vulnerabilities. The fact is, cybercriminals have become much less methodical when launching attacks against organizations, oftentimes casting their nets with no specific target in mind, just to see what they can find. As a result, many of the hits against the supply chain are “accidental” – third-party collateral due to unsecure backdoors uncovered by attackers. Whether the supply chain was the initial target of the attack, or became the attack vector as an opportunistic hit, the approach to ransomware protection is only as effective as all of its ingredients. That means – effective supplier collaboration and transparency, robust data backup, and improved security maintenance.

The Supply Chain’s Ripple Effects

Supply chains are an incredibly complex web of trading partners, commerce transactions, logistics and more. This complexity is compounded by the fact that there are tier-two and -three suppliers within your own supply chain that you may not even know exist but could still impact your business if they are the target of a ransomware attack. You may not be the target, but you can still be a victim as their breach extends to their trading partners.

In light of this, it’s absolutely fair game – and smart business practice – to ask your suppliers how they are improving security measures and protecting against ransomware attacks. Now is the time to ask about quality standards, security practices, abilities to understand data protection/the transparency into their dependencies and what you could be potentially exposed to based on their business activities. A thorough approach to supply chain management takes into consideration that you’re only as secure as your least secure trading partner or supplier. You can do everything perfectly in terms of your own security measures, but one supplier’s laps in security can spoil the bunch. It’s within your rights as a business to ask this of your suppliers. 

Don’t Skimp on Data Backup

Any good business leader knows there are areas and departments where you can safely cut costs without significant risk, and other places to double down when it means protecting your business. Data backup and recovery is one such area where no business should cut costs or corners, especially with the rise in ransomware. While a robust backup and recovery strategy won’t alone keep you safe from ransomware attacks, it will put businesses in a much better position when the inevitable does occur – leaving hackers left with less options when you’re able to recover critical data quickly on your own.

It’s not just about implementing the right data solutions though, but also about maintaining and consistently testing them. It’s critical to consistently test your backups in advance of an attack – because it won’t do you any good after the fact. One way to do this is to think like the hackers. There are many different ways to simulate attacks, including hiring professional, ethical hackers who can purposely look at and target your vulnerabilities to find out where you’re most at risk – but with no real-world danger of data theft or loss. If you can’t hire these simulation actors, it’s important to test your backup and recovery solutions frequently and thoroughly on your own as often as you can to find and resolve risks.

Review & Enhance Your Security Standards and Best Practices

It’s no secret the COVID-19 pandemic led to an increased state of urgency for enterprise security – overnight people were thrust into work-from-home scenarios, with little-to-no time for IT departments to prepare. And when you move fast there’s a lot of potential for mistakes. From a security perspective, the cloud is still new for many organizations, especially those that moved to the cloud hastily or in a rush out of necessity. For all organizations, regardless of their IT department’s cloud sophistication, it’s a best practice to revisit all protocols that were adopted as part of the initial cloud migration to ensure they’re secure, hardened and cost effective. Especially as security and hyperscale cloud settings can change at a moment’s notice (options, etc.), there’s a need to continually monitor, evaluate and implement the latest security standards. It’s on IT to identify exposures and vulnerabilities, and surface them up to management to secure C-suite support and budget. 

Hackers continue to get more sophisticated, with new trends like ransomware-as-a-service (RaaS) – a consumer-driven offering that multiplies the volume of attackers by lowering the technical skill required to launch a ransomware attack. Like a game of chess, as your opponent (hackers) evolve, so does your defense strategy need to evolve. To prepare, organizations need to follow the right recipe of supply chain transparency, data backup and security maintenance and testing. Failure to do so could result in your business getting its 15 minutes of fame as the next victim of ransomware.  

The author is Senior Director - Product Strategy at Veeam