Supply Chain Cyber Security
The digital transformation of the global supply chain allows companies to work closer together, integrating data and often sharing information to create efficiencies while reducing costs. Yet each supplier brings a risk of introducing vulnerabilities to your network and it is estimated that round 80% of data breaches originate in the supply chain. A supply chain is only as cyber-secure as its weakest link and we have seen smaller organisations being targeted and used as a vehicle to access corporate infrastructures:
- Equifax - US Credit Rating Company Equifax suffered a breach which resulted in the loss of over 100 million user details. The breach was blamed on a weakness introduced via their supply chain.
- Debenhams –a breach resulting in the loss over 20000 user details originated in a cyber-attack within their supply chain via the supplier of their online florist services.
From global conglomerates to SMEs – we all need to address the inherent cyber-security risks within our supply chain. Data can be damaged accidentally, accessed by cyber-criminals or employees who are an insider threat. Undertaking an audit of your suppliers and understanding who has access to which levels of your corporate data is the first step to addressing risk. It can be useful to categorise suppliers so you can consider how best to manage the risks they bring. A supplier who provides services on-site will bring different risks to those who provide ICT services and can access your company data. It can be useful also to consider your rules on subcontracting, consultants and partners. Once you have established who has access to what categories of data, you can work out how to manage the risks and introduce methods of monitoring and evaluation.
Cyber –security certification
While you can be safe without certification, they can be a useful method of ascertaining that your suppliers take cyber-security seriously. There’s an increasing requirement within the tendering process for certification to a recognised cyber-security standard:
- The UK Government’s Cyber Essentials Scheme aims to ensure your system is protected from basic threats. Their website offers a useful search tool which will allow you to check which of your suppliers have this in place: https://www.cyberessentials.ncsc.gov.uk/cert-search/?query=
- Internationally recognised standard ISO 27001 outlines best practise for a robust Information Security Management System and requires an ongoing commitment to external audits & continual improvements to check standards are being maintained. There is no central database of certification – you need to check with each individual supplier.
Our technical consultants have a strong understanding of both schemes and we are accredited ACE Practicioners of the Cyber Essentials scheme. We have supported many of our IT support customers across Glasgow, Edinburgh and central Scotland in becoming certified and we are happy to help you work out which of the available certifications is best suited to your business needs. Contact us for more info.
RedMosquito provides IT support across Glasgow, Edinburgh and throughout Scotland.