Coronavirus: securing the supply chain during remote working

The coronavirus is pushing the economy, companies and the workforce in new directions that were not even dreamed of just a few short months ago. 

The ability of this virus to spread quickly is forcing companies almost overnight to adopt a work-from-home policy. These difficult times have introduced not just IT and company culture challenges, but have also created a mountain of cybersecurity challenges that companies must face because of a sudden shift to remote working on a massive scale. With this change, companies are not only going to have to layout policies for their own workforce, but also for their vendors in the supply chain whose security will be impacted as well. 

This transition is introducing a myriad of security complications with employees lacking technical support, using their own potentially unvetted devices for corporate purposes, using their own networks and possibly connecting to sensitive corporate data. It is a recipe for disaster that only gets worse as this tidal wave of change and uncertainty washes over the supply chain, which cybercriminals are sure to exploit. While some larger companies may be more prepared with comprehensive contingency plans, some smaller companies in the supply chain may not. 

Building a Defensive Wall 

The first line of defence will always be employees. Now, more than ever, immediate education and reminders should be provided to employees who must be schooled on the possible risks from working at home versus a corporate, controlled environment. Phishing will be one of the biggest challenges that employees will be facing, especially as cybercriminals seek to exploit consumer fear by targeting irregularities in daily activity. This means that employees will most likely begin to see an increase in spam and phishing emails relating to coronavirus that pressure users to click on harmful links that may be disguised as health advice or government warnings. In addition, with the move to an all-inclusive email work environment, there will also be an increase in payment transaction requests, including fraudulent ones. With less stringent verification controls, such online fraud will be on the rise.

Companies will have to tighten communications with solid verification procedures for critical financial transactions, account access resets, credentials and the sharing of personal information. Employing two-factor authentication across all systems should be immediate, as well as increased monitoring of all systems. This will prove to be a difficult task, as the rising number of personal devices accessing corporate information will require monitoring. Managed Security Service Providers are able to help companies increase their ability to review alerts and logs and provide or complement with a continuous eye on all activities.

Looking Down the Supply Chain

While the bigger companies have more resources to handle this fire drill, the smaller companies intertwined within the supply chain may not. So, if one of the smaller companies gets hit by a cyberattack, the repercussions would be felt at the upstream partner. According to a Ponemon Institute study from 2018, 61% of US companies experienced a data breach through their suppliers. With suppliers now moving to work from home, the security of the supply chain makes this issue all the more severe. 

SEE ALSO:

• Ford unwilling to reopen assembly plants because of COVID-19

• COVID-19: Could DoorDash save US restaurants?

• COVID-19: automotives provide manufacturing support

• Read the latest issue of Business Chief, USA, here

In order to ensure the cyber resilience of the supply chain, companies must assess their suppliers’ security preparedness for a remote workforce. Questions should be asked in relation to authorization and authentication, resilience and business continuity, and procedures and processes. Here are some questions that companies should ask their suppliers:

1. Do you already have remote work practices and policies?

2. How many of your employees already have remote work capabilities?

3. How much of your day-to-day activity is suitable for remote working today? 

4. What is your remote access mechanism?

5. Which client devices are allowed to access your digital assets remotely?

6. Do you enforce 2FA for employees with remote work capabilities?

7. Do you enforce strong passwords for all employees?

The answer to these questions will help companies reduce their potential risk, and by extension, implement steps that must be taken to mitigate specific challenges. Even in the best of times, things can go wrong. Having a response management plan in place is key.

Companies will even have to be prepared to give those in the supply chain remediation plans for closing those security gaps. During this upheaval, regular spreadsheet evaluations will not be efficient enough and the whole process will have to be automated to keep up with checks and balances that have to be made. If companies want to succeed in their transition to a fully remote workforce, they must ensure that their security policy is also enforced with their suppliers. 

By Elad Shapira, Head of Research for Panorays