A breach at any point in the digital supply chain can quickly compromise services, consumers, users, and brand reputation. To combat digital supply chain threats, businesses must be proactive in addressing vulnerabilities across their whole external attack surface, including third parties.

1. 6/14/22, 2:53 PM Four Ways Businesses Can Secure Themselves from Digital Supply Chain Attacks
https://itsecuritywire.com/featured/four-ways-businesses-can-secure-themselves-from-digital-supply-chain-attacks/ 1/2
Four Ways Businesses Can Secure Themselves from
Digital Supply Chain Attacks
A breach at any point in the digital supply chain can quickly compromise services, consumers, users, and brand
reputation. To combat digital supply chain threats, businesses must be proactive in addressing vulnerabilities
across their whole external attack surface, including third parties.
According to Gartner’s “Top Security and Risk Management Trends for 2022,” digital supply chain security is now
one of the top three security issues for cybersecurity teams, CISOs, and the entire C-suite. Digital supply chain
attacks pose a threat to the business continuity of large-scale organizations.
Almost every mission-critical function in a business is connected to a digital supply chain. All Internet-facing
services are supported by a multi-tiered network of third-party services and infrastructure. Every third party, in turn,
has its own third parties, who have their third parties, and so on. As a result, the vulnerabilities of vendors often
become the enterprise’s vulnerabilities.
Threat actors understand that exploiting a vulnerability deep within the digital supply chain is easier than attacking
a company directly. This is why, for most businesses, digital supply chains are the fastest-growing attack surface.
Addressing Threats to the Digital Supply Chain
Enterprises must implement a proactive threat prevention approach and address vulnerabilities before they
become catastrophic breaches to reduce the risk of attack via digital supply chain vectors.
Automate Asset Discovery
Businesses can’t defend what they can’t see, so they need to find out what’s out there ahead of time. They must
locate and map all externally facing known and unknown assets, including those introduced through shadow IT
initiatives. They should examine the uncontrolled assets that make up their digital supply chain, regardless of how
far downstream they are.
Also Read: How to Close the OT Cybersecurity Talent Gap
By Prangya Pandab - June 13, 2022

2. 6/14/22, 2:53 PM Four Ways Businesses Can Secure Themselves from Digital Supply Chain Attacks
https://itsecuritywire.com/featured/four-ways-businesses-can-secure-themselves-from-digital-supply-chain-attacks/ 2/2
Evaluate Vulnerability
Businesses need to understand which external assets are vulnerable, how they may be exploited, and the degree of
the risk they pose once they know what they have. They should also follow the connections by undertaking an in-
depth and extensive connection-oriented evaluation, which will reveal how assets downstream are weak and how
that vulnerability can be transmitted back up the digital supply chain, posing a security risk.
Monitor Constantly
It’s possible that what was secure yesterday won’t be secure tomorrow. Businesses must ensure that they are
always examining their external attack surface and supply chain for new assets. They should re-evaluate each
third-party asset, distributed cloud infrastructure, and externally facing Internet assets. They must look for
misconfigurations and vulnerabilities in the digital supply chain.
Prioritize Risk and Devise a Remediation Strategy
What should the team focus on first? Do they have an actionable remediation plan for both the digital supply chain
and the external attack surface based on vulnerability prioritization?
It’s essential to apply these strategies to both direct Internet-facing assets, and key areas like:
Cloud-based services: Security of the cloud is critical to business continuity. Cloud misconfigurations are the
most common source of vulnerabilities. Creating an end-to-end inventory of assets across all cloud vendors is
essential. Businesses must leverage this dynamic inventory as the foundation for continuous risk management
and monitoring.
Subsidiaries: Digital assets belonging to subsidiaries but tied to the primary business could be dangerous. It’s
critical to evaluate and mitigate that risk.
M&As: Networks may still contain connected assets following M&As, and divestitures. As part of any M&As, and
divestitures, it’s vital to understand the risk signature of newly acquired or abandoned digital assets.
For more such updates follow us on Google News ITsecuritywire News
Prangya Pandab
https://itsecuritywire.com/
Prangya Pandab is an Associate Editor with OnDot Media. She is a seasoned journalist with almost
seven years of experience in the business news sector. Before joining ODM, she was a journalist with
CNBC-TV18 for four years. She also had a brief stint with an infrastructure finance company working for
their communications and branding vertical.