BSides Delhi 2018: Securing Supply Chain- A Risk Based Assessment Framework
Presenter: Prithvinder Singh & Prashanth Sulegaon Abstract: What is supply chain security? Supply Chain is a system of organizations, people, process, information, technology and resources involved in moving a product or service from a supplier to the intended customer. An unsecured supply chain can introduce great risk to any organization and if vendors, solutions or hardware aren’t properly vetted, it can lead to huge data loss. Why is it required? An unsecured supply chain can introduce great risk to an organization. If vendor aren’t properly vetted, or if we purchase software that does not meet our security standards, we can lose data. These days several companies have had data breaches that allowed hundreds of millions of customer records to be compromised. On average, it takes 229 days after a breach for it to be detected. Often, these breaches were caused by a vulnerability in third-party software or services being exploited, costing companies tens of millions of dollars and damaging customers’ confidence. In this Session: Everyone knows, 3rd party softwares bring lot of risk to an organization. However does traditional vetting of supplier solutions work? Will it really reduce the risk? can we perform effective assessments? Is it scalable? Can we do continuous monitoring? In this session we will talk about what are the risks currently associated with the 3rd Party Softwares and how to surface them for effective risk reduction. This session will focus on securing supply chain using risk based 3rd party framework which encompasses integration of multiple security checkpoints at various stages of solution life cycle We will talk about: * Supply Chain Universe * Current challenges in Supply Chain Security * Secure life-cycle of 3rd party software from on-boarding till termination. * Supplier Risk Profiling * Point in time vs Continuous Assurance
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to BSides Delhi 2018: Securing Supply Chain- A Risk Based Assessment Framework
Similar to BSides Delhi 2018: Securing Supply Chain- A Risk Based Assessment Framework (20)
Recently uploaded
Recently uploaded (20)
BSides Delhi 2018: Securing Supply Chain- A Risk Based Assessment Framework
- 1. Speakers: Prithvinder Singh & Prashanth Sulegaon Securing Supply Chain – A Risk Based Assessment Framework #BSidesDelhi2018
- 2. What is Supply Chain? Software Supply Chain Source/ Dependencies Build Systems/ Engineers Application Repo Deployed System Network Traditional Supply Chain #BSidesDelhi2018
- 3. WHY IS SUPPLY CHAIN “SECURITY” IMPORTANT? #Besides2018 #BSidesDelhi2018
- 4. Breaches due to 3rd party solutions #BSidesDelhi2018
- 5. AT LEAST 56%of organizations have had a breach that was caused by one of their vendors 49 56 2016 2017 TrendYoY On Average, U.S Companies Pay $7,350,000PER BREACH IN FINES, REMEDIATION COSTS AND LOSS OF CUSTOMERS - UP 10% #BSidesDelhi2018Source- https://www.opus.com/ponemon/
- 8. 57% Don’t have an inventory of 3rd parties with which they share sensitive information JUST 17% feel they’re highly effective at mitigating third-party risks 60% Feel Unprepared to tackle the underlying risk COMPANIES LACKVISIBILITY INTO THE SECURITY PRACTICES OFTHIRD PARTIES, BUT CONTINUETO SHARE DATA #BSidesDelhi2018Source- https://www.opus.com/ponemon/
- 9. HOW TO ADDRESS THIS PROBLEM? #BSidesDelhi2018
- 10. Supply Chain Universe Solutions - SaaS - COTS - Desktop Services - Hardware - Consulting - Staffing Supply Chain Universe Factory -Testing - Manufacturing Offshore Facility #BSidesDelhi2018
- 11. Types of Solutions SaaS /Third Party Hosted solutions COTS / Server Software / On-prem solutions Desktop / Client Only / Stand Alone solutions Hybrid Solutions / IoT / SMART device solutions Open Source / Freeware solutions #BSidesDelhi2018
- 12. Challenges Inventory- No single source of truth Coverage – Breadth vs Depth Limited Resources/Skills Focus on Risk driven decision Ineffective use of contracts #BSidesDelhi2018
- 13. “PRIORITIZATION” IS THE KEY #BSidesDelhi2018
- 14. Key Risk Indicators Spend Data Storage Data Sensitivity Critical Systems GDPR Connectivity External Endpoints PII User Count HighRiskEnvironments Compliance Instance Count #BSidesDelhi2018
- 15. Prioritization Model P0 P1 P2 Deep Dive Baseline Monitor & Respond Rejected Apps • Cloud Storage • External Endpoint • Corp Connected • Connectivity product (router/FW) • Spend • Internet connected • On Prem data • High use apps / user count • Non-Corp connected • Data Migration tools • Standalone apps • Peripherals Risk #BSidesDelhi2018
- 17. P2 • Operational Controls P1 • Attestation • Threat Model Review • Static Analysis • Dynamic Analysis • Industry Certifications • Operational Controls P0 • Attestation • Pen-testing • Threat Model Review • Static Analysis • Dynamic Analysis • Red Team Pen Test • Manual Code Review (if available) • Host Configurations • Industry Certifications • Operational Controls #BSidesDelhi2018
- 19. Point-in-Time vs Continuous Assurance Monitoring Reassurance Assessments [Point inTime] • Architecture Review • Manual/ Automated Pen-test • Control/Configuration Review • Vendor Attestation • Continuous Scanning • Risk Profiling • Remediation • Re-assessment based on the Risk #BSidesDelhi2018
- 20. Key areas to focus • Identify the key gaps in your supply chain program • Adopt or create your own risk based framework for your entire supply chain • Apply Risk based prioritization model per your org needs to ensure critical risks are addressed first • Review your contracts language • Move your program from point in time to continuous monitoring • Define KPIs which are impactful and tell the story of your program #BSidesDelhi2018