February 21, 2018 By Douglas Bonderud 2 min read

When attackers want to compromise corporate networks, they find weak links in the chain. Cybercriminals aren’t in the business of going head to head with network security solutions — they prefer undetected, unprotected entry points.

As noted by SecurityWeek, this often leads to supply chain attacks. Even companies with solid security policies are at risk of data breaches if third-party suppliers don’t safeguard their own assets. A recent cybersecurity risk assessment revealed a significant disconnect between federal agencies and approved government contractors, putting the entire supply chain under threat.

Cybersecurity Risk Assessment Reveals Supply Chain Security Gaps

While federal agencies are under increasing pressure to meet security best practices, such as National Institute of Standards and Technology (NIST) security guidance and standards, supply chain organizations further down the pipeline may escape direct observation, making it easy to avoid costly IT changes.

A recent BitSight survey compared the security performance of 120 agencies to 1,200 contractors. It found a performance gap of at least 15 points on a cybersecurity risk assessment scale of 250–900, with higher scores equating to stronger security posture.

Of greater concern were specific issues common to supply chain contractors, which were rated on an A–F scale. For example, 20 percent of those surveyed said they still use outdated internet browsers, putting them at risk of new malware vectors. In addition, almost 50 percent of contractors received a C grade for their use of protective technologies in line with the NIST cybersecurity framework.

Put simply, federal agencies are doubling down on cybersecurity, but supply chain contractors aren’t keeping pace.

Sniffing Out Supply Chain Threats

The first step toward improving supply chain security is recognizing the problem. As noted by FCW, that’s the idea behind a new internal supply chain cybersecurity initiative launched by the U.S. Department of Homeland Security (DHS). The program aims to dig down and discover exactly where supply chain threats are coming from. Using a “focused effort with dedicated staff,” the agency is partnering with NIST to unpack critical risks and develop mechanisms to improve overall security.

This may be easier said than done. As Federal News Radio pointed out, while NIST guidelines offer a solid starting point, the next step for supply chain security is creating frameworks that provide “consistent ways to measure the effectiveness of security controls.”

It’s not enough to simply spend more on security and check off cybersecurity risk assessment boxes. Contractors and federal agencies must be able to actively and reliably monitor supply chain security controls to see what’s working, what isn’t and where new security solutions offer the biggest benefit.

Federal supply chains are at risk, with contractors lagging behind agencies when it comes to NIST adoption and threat awareness. Improving overall security means recognizing the shortfall and implementing effective controls that both meet minimum standards and provide active, accurate feedback about security efficacy.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today