ENISA Predicts Fourfold Increase in Software Supply Chain Attacks in 2021, Warning That Strong Cyber Defenses Were No Longer Effective

By Alicia Hope for CPO Magazine
Monday, August 16, 2021

• 4.2k
• 40
• 41
• 40
• 18
• More
• 40
• 40

The agency also advised suppliers to ensure that their product development lifecycles apply cybersecurity best practices, monitor internal and external security vulnerabilities, including third-party components, and maintain an inventory of assets for easy tracking and patch management.

“There is a clear trend to exploit misconfigured CI/CD pipelines and vulnerable cloud deployments,” says Ilia Kolochenko, Founder, CEO, and Chief Architect at ImmuniWeb. “Amid the pandemic, countless organizations rapidly moved their IT infrastructure to a cloud, while trying to save money on training and cloud-specific security hardening. Combined with legacy IT infrastructure, third-party managed servers, and software, the digitalization in 2021 made organizations a low hanging fruit for cybercriminals.”

Most supply chain attack vectors remain unknown

ENISA report found that in two-thirds (66%) of the supply chain attacks, suppliers did not know or were not transparent on how they were compromised.

Contrarily, less than 9% of customers compromised through the supply chain attacks failed to understand how the attacks happened. The difference highlighted a cybersecurity incident reporting gap between suppliers and customers.

The authors posited that considering that most compromised suppliers operate in the technology sector, there is either a poor level of maturity in protecting suppliers’ infrastructure or an unwillingness to disclose information. They warned that the lack of transparency posed serious risks to the supply chain.

“Cyber-gangs are much better organized compared to the cybersecurity industry,” Kolochenko added. “They meticulously plan and coordinate their attacks, leverage division of labor, and eventually attain impressive efficiency. Contrasted to cybersecurity teams, bad guys are never on holidays or sick leave, and will even purposely conduct swift raids while the victim organizations are the most unprepared.” Read Full Article