Supply chain attacks, such as the famed SolarWinds attack, are increasing in both number and sophistication. In fact, as this new increased in both number and sophistication.
This new report from the European Union Agency for Cybersecurity entitled Threat Landscape for Supply Chain Attacks maps and studies a total of 24 such attacks from January 2020 to early July 2021.
It defines a supply chain cyberattack as:
“[A] combination of at least two attacks. The first attack is on a supplier that is then used to attack the target to gain access to its assets. The target can be the final customer or another supplier. Therefore, for an attack to be classified as a supply chain one, both the supplier and the customer have to be targets.”
This is an accelerating trend, the authors warn. Based on the trends and patterns so far observed, they estimate there will be four times more supply chain attacks in 2021 than there were in 2020. Half of these attacks are attributed to Advanced Persistence Threat actors who have resources and capabilities for complex and targeted attacks that can take months or even years to execute.
These can have far-reaching impacts and require a robust and coordinated response from both industry and government, they write.
“Supply chain attacks leverage the interconnectedness of the global markets. When multiple customers rely on the same supplier, the consequences of a cyber-attack against this supplier are amplified, potentially resulting in a large-scale national or even cross-border impact.”
Reducing some of the many unknown factors is crucial to combating these crimes, the authors write. Given that 66 percent of the attack vectors used on suppliers still remain unknown, improving the process of transparency and accountability would greatly improve the ability to investigate and prevent these incidents.
