The supply chain is only as strong as its weakest link. For logistics companies operating in an evermore complicated cybersecurity and technological environment, this is third-party partners. A recent report from Hexnode surveyed 1,000 IT professionals across small and mid-sized supply chain organizations and revealed a deeply concerning trend. Over half (52%) of the organizations encountered cybersecurity incidents stemming from third-party vendors on at least one occasion. Threat actors are exploiting this weak link by striking trusted partners to infiltrate their true targets. As a result, hackers bypass traditional defenses and get in the back door to wreak some real damage – disrupting operations, compromising data, and damaging reputations. Strong third-party risk management (TPRM) programs are the solution, yet the report alarmingly found that almost one in five (15%) businesses bypass this critical process altogether. Let’s explore how logistics operators can safely leverage the expertise of third-party partners while protecting themselves from what’s increasingly the supply chain’s ignored vulnerability. Third-Party Risks Are Real Supply chains are built upon intricate networks of relationships between organizations and their third-party service providers. However, malicious actors know this and are more often trying to infiltrate the target organization by exploiting a trusted component or software within the supply chain, thereby circumventing traditional security measures and catching victims off guard. The Okta breach in 2023 is a glaring example of third-party risk. In this instance, a hacking group executed a supply chain attack targeting Okta’s customers rather than Okta itself, exposing several financial institutions, including Western Union, Ally, and Amalgamated Bank, to potential threats. In the face of constantly evolving  tactics, organizations must remain vigilant against threat actors. How? By giving far more budget and attention to the programs overseeing these third-party relationships. Analyze, Monitor, Remediate In light of this threat, companies have no choice but to strengthen their TPRM programs. This requires analyzing the risks posed by working with outside services, engaging with vendors to assess their security posture, and remediating any identified weaknesses. And, if push comes to shove, companies need to delay deployment until the resulting security issues are addressed. Risk tolerance, vendor criticality, and compliance requirements should then guide organizations on whether it’s safe to onboard the vendor or find alternative solutions. If companies decide to proceed with the partnership, it’s important to keep an eye on their security and compliance with regular checkups. After all, these partners now have access to internal systems and sensitive data to deliver their services (the exact information hackers are targeting). Alarmingly, more than 15% of businesses bypass this process and don’t look into how or if partners protect data. This just isn’t good enough. In this day and age, with known risks and increasing cyberattacks, the buck stops with logistics companies. It’s up to them to define their third-party risk tolerance, ensure a reliable method for handling such risks, and create a system for continually assessing and monitoring the security of the partnership. Be Proactive With Partners Of course, this isn't to say third-party platforms and partners are without value. They can be important external resources that take the pressure off internal teams with time-consuming or technical tasks. But, and it's worth reporting, these partnerships should be entered into with a healthy dose of caution. Therefore, logistics can no longer afford to treat third-party cybersecurity as an afterthought. Increasingly, it's just as important as internal defenses. This demands investing in better internal and external security as well as better partner vetting. If companies aren't up to standard, don't take the risk. It's that simple. Additionally, train your staff with regular security seminars and workshops. Employees are the first line of defense and can be your eyes and ears on the ground. If there's something wrong on the backend, or partner profiles are acting strangely, they can see and say something. Help them help you. The takeaway here is to take matters into your own hands. Instead of waiting for clients or customers to discover breaches, supply chain companies today must arm themselves with the necessary tools and training to detect and respond immediately. Only by championing a holistic, vigilant approach can supply chain companies weed out poor partners and protect themselves from this underappreciated threat. The supply chain is only as strong as its weakest link. For logistics companies operating in an evermore complicated cybersecurity and technological environment, this is third-party partners. A recent report from Hexnode surveyed 1,000 IT professionals across small and mid-sized supply chain organizations and revealed a deeply concerning trend. Over half (52%) of the organizations encountered cybersecurity incidents stemming from third-party vendors on at least one occasion. Threat actors are exploiting this weak link by striking trusted partners to infiltrate their true targets. As a result, hackers bypass traditional defenses and get in the back door to wreak some real damage – disrupting operations, compromising data, and damaging reputations. Strong third-party risk management (TPRM) programs are the solution, yet the report alarmingly found that almost one in five (15%) businesses bypass this critical process altogether. Let’s explore how logistics operators can safely leverage the expertise of third-party partners while protecting themselves from what’s increasingly the supply chain’s ignored vulnerability. Third-Party Risks Are Real Third-Party Risks Are Real Supply chains are built upon intricate networks of relationships between organizations and their third-party service providers. However, malicious actors know this and are more often trying to infiltrate the target organization by exploiting a trusted component or software within the supply chain, thereby circumventing traditional security measures and catching victims off guard. The Okta breach in 2023 is a glaring example of third-party risk. In this instance, a hacking group executed a supply chain attack targeting Okta’s customers rather than Okta itself, exposing several financial institutions, including Western Union, Ally, and Amalgamated Bank, to potential threats. The Okta breach The Okta breach In the face of constantly evolving  tactics, organizations must remain vigilant against threat actors. How? By giving far more budget and attention to the programs overseeing these third-party relationships. Analyze, Monitor, Remediate In light of this threat, companies have no choice but to strengthen their TPRM programs. This requires analyzing the risks posed by working with outside services, engaging with vendors to assess their security posture, and remediating any identified weaknesses. And, if push comes to shove, companies need to delay deployment until the resulting security issues are addressed. Risk tolerance, vendor criticality, and compliance requirements should then guide organizations on whether it’s safe to onboard the vendor or find alternative solutions. If companies decide to proceed with the partnership, it’s important to keep an eye on their security and compliance with regular checkups. After all, these partners now have access to internal systems and sensitive data to deliver their services (the exact information hackers are targeting). Alarmingly, more than 15% of businesses bypass this process and don’t look into how or if partners protect data. This just isn’t good enough. In this day and age, with known risks and increasing cyberattacks, the buck stops with logistics companies. It’s up to them to define their third-party risk tolerance, ensure a reliable method for handling such risks, and create a system for continually assessing and monitoring the security of the partnership. Be Proactive With Partners Be Proactive With Partners Of course, this isn't to say third-party platforms and partners are without value. They can be important external resources that take the pressure off internal teams with time-consuming or technical tasks. But, and it's worth reporting, these partnerships should be entered into with a healthy dose of caution. Therefore, logistics can no longer afford to treat third-party cybersecurity as an afterthought. Increasingly, it's just as important as internal defenses. This demands investing in better internal and external security as well as better partner vetting. If companies aren't up to standard, don't take the risk. It's that simple. Additionally, train your staff with regular security seminars and workshops. Employees are the first line of defense and can be your eyes and ears on the ground. If there's something wrong on the backend, or partner profiles are acting strangely, they can see and say something. Help them help you. The takeaway here is to take matters into your own hands. Instead of waiting for clients or customers to discover breaches, supply chain companies today must arm themselves with the necessary tools and training to detect and respond immediately. Only by championing a holistic, vigilant approach can supply chain companies weed out poor partners and protect themselves from this underappreciated threat.

The is an opinion piece based on the author’s POV and does not necessarily reflect the views of HackerNoon.

Third-Party Vendors Are the Supply Chain’s Ignored Vulnerability

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Health Hackers Are Exploiting Deceased Patient Data, Here’s How We Stop Them

Windows Sticky Keys Exploit: The War Veteran That Never Dies

06/02/2018: Biggest Stories in the Cryptosphere

0-Days are on the Rise and that Means a Lot More Work for SOC Teams

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

The Noonification: How the Liver Transplant System Changed Forever (11/25/2023)

Health Hackers Are Exploiting Deceased Patient Data, Here’s How We Stop Them

Windows Sticky Keys Exploit: The War Veteran That Never Dies

06/02/2018: Biggest Stories in the Cryptosphere

0-Days are on the Rise and that Means a Lot More Work for SOC Teams

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

The Noonification: How the Liver Transplant System Changed Forever (11/25/2023)

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps