teissTalk: Building cyber-resilience across your digital supply chain

Views on news

A major cyberattack on medical device manufacturer Boston Scientific resulted in delayed orders, backlogs and intermittent product availability for the NHS Supply Chain. The incident is yet another evidence that the lessons of previous attacks still haven’t been learnt. Although the NHS has set up a threat team to investigate the incident, the vulnerability existed long before someone decided to take advantage of. While the technological aspect is critical to incident response, it will also be key how the NHS and the Boston Scientific leadership answers questions from their respective governments regarding how the breach happened. In this case, Boston Scientific and the NHS have demonstrated how a good relationship with suppliers and a well-thought out response plan can help remediate hacks when they happen. Hacks gradually stop being a technological issue nowadays as they impact the whole business operation. 

Verifying multi-tier suppliers and leveraging procurement as an additional layer of defence

Some companies still use spreadsheets to track threats as they can’t afford security score cards, MetricStream or AI tools.  But they can also map out the network of their fourth or fifth party suppliers and contractually commit their suppliers further up the chain to reporting incidents that happened to their second and third parties. The point is that you must use your second and third tier of suppliers to control the fourth and fifth level through supplier contracts. Tracking relying on spreadsheets is better than having no tracking at all. But you must make sure that the spreadsheet is saved in another system and is accessible during a cyber incident. Contracts, on the other hand, shouldn’t be stashed away in drawers and files but leveraged when working out recovery plans or prioritising assets. However, it may happen that a critical vendor won’t sign your business’s security standards and tells you to take or leave their service. In that case, consider whether you can trust a tech giant anyway based on their robustness and longevity or switch to another one. You can also tell them that you don’t trust them but will work with them, putting your own controls in place. 

You need an old-fashioned networking and relationship building approach to build a good partnership with your critical suppliers. But always make sure you have documented ways of working with them to be able to benchmark what actually happened in real life against the document. DORA has also reinforced partnerships through collaboration with suppliers’ red teams, spreading responsibility and the scope for control. All this may get overwhelming for businesses, especially small ones, as they can feel swamped by all the information available for them. 

Engage procurement in cyber security, making them understand why the continuous checking of suppliers for expired contracts and new certifications are key and implement platforms that enable this workflow. At the same time, don’t forget that certifications are only a starting point. When highly technical purchases are made, you can collaborate with procurement through RFPs and through adjusting the scoring used to select suppliers to ensure that t’s weighted towards your priorities. Consider procurement as an additional layer of defence. 

The panel’s advice

• Businesses don’t do enough incident response planning before an incident happens. In the absence of provisions for a cyber attack in the contract with the supplier, you can only rely on hope an goodwill.
• You won’t be able to stop cyberattacks. What you can do is respond to them professionally.
• Make sure your supplier contracts contain all the right clauses. Never take it for granted that the contract with a supplier exists.  
• Look at the things you really care about and protect those first.
• Document everything to create a defensible, justifiable position when it comes to regulatory investigations.