WATCH CASE STUDY
On June 27, 2017, confused Maersk employees are showing up at the IT helpdesk with their laptops in their hand. The numbers were increasing by the minute. Their laptops were encrypted and very much useless at this point. What happened?
Maersk was hit with the most popular ransomware attack in the history of the internet. 56,000 devices were encrypted in just a few minutes. 100% of the devices connected to the Maersk network were encrypted. Maersk ships 25% of the world's food supply and the whole operation came to a grinding halt due to this ransomware attack. What happened?
There are a number of lessons to learn from this story and the biggest one is about securing your supply chain. The attack on Maersk originated from their supplier that provided the accounting package to the company. The supplier’s servers got compromised, the malware was injected into the software update and every company that’s using the package was hit. The attack cost Maersk a total of $350,000,000 and overall cost $10 billion to all the businesses that were impacted as a result of this particular ransomware attack.
A recent survey shows that 6 out of every 10 businesses that had a cyber attack will never recover and eventually collapse. In previous posts we have addressed the steps you can take to protect your business, which you can read here.
But even if you take Cyber Security seriously in your company, often businesses ignore the threats that come from the supply chain.
What can you do?
Understand the risks
What’s the risk? What information and data do you share with your supplier? Categorise your supply chain to make it easy and understand your supplier’s attitude to security. For example, if it’s a cleaning company they may not pose the highest risk whereas a cloud system provider will, so categorise all your suppliers by low, medium or high risk.
Establish a baseline
Once you identify the risks and categorised your suppliers it’s time to set the minimum security standard for each category. Communicate the standards to your suppliers and raise awareness for these standards. Build the baseline security measures into your supplier contracts. While you are at it you will want to make sure you are adhering to those standards as a customer and supplier. It’s a good idea to build your vendor risk assessments.
These controls are not just for big businesses. Even the smallest businesses/suppliers can be a risk to your security. A good starting point for small businesses and even sole traders can be asking for an industry-supported Cyber certification.
At the very least, ask for a copy of their Cyber Security policy.
The number of businesses losing money to supply chain fraud is humongous. You definitely don’t want to be losing your hard-earned money because your supplier wasn’t taking security seriously.
It is one thing to get your suppliers to comply with your baseline requirements and another thing to follow up regularly. Cyber Security is a constantly evolving beast and one would need to keep up with the changes, the latest threats and trends. Build a good relationship with your suppliers to give each other a heads up if there is a cybersecurity issue that crops up that both parties should know about.
I hope that helps you to get started. If you want to get started with getting your Cyber Security sorted here is a free 10 step guide to help.
- What is Phishing and what can you do to prevent it?
- Found malware, now what do you do?
- Data breaches and other scary 2019 events- Special Halloween post
- How to get your cyber security budget approved by the board
- The TechForce Sponsorships
- How to start a career in the security industry
- Protecting your business in the cyber security era
- Case study: British Airways Fined £183.4million for Data Breach
- The Silver Bullet in Cyber Security
- Fake invoice email scams and Office 365
- How to apply for the Cyber Essentials Voucher Scheme
- What is Business Email Compromise (BEC) and how to stop it
- Everything you need to know about Cyber Essentials
- Cyber Essentials Demystified
- How to choose a Security Awareness Platform
- 6 Quick and Easy Email Security Tips for Dummies
- Hackers On Tour
- How to share passwords safely in your Small Business
- In the news - Warning. North Sea firms likely already attacked
- 10 Steps to Cyber Security
- 6 Top Tips to Prevent Cyber Attacks
What is Phishing and what can you do to prevent it?
Phishing is a type of online scam where criminals send an email that appears to be from a legitimate company and ask you to provide sensitive informationMore
Found malware, now what do you do?
You’ve found some malware on your computer, so what should you do next? What’s the best approach? We’ll run through a few things that will greatly assist in identifying and isolating the malwareMore
Data breaches and other scary 2019 events- Special Halloween post
It’s that time of the year again, where the ghosts come out of the cupboard and the witches cackle. These are the scariest parts of cyber security from 2019 and the scale of how scary they actually are.More
How to get your cyber security budget approved by the board
There’s a few ways to improve the approach to the company board that will significantly help to get them onboard with improving cyber security, especially when linking this to risk mitigation.More
FOR LATEST UPDATES SUBSCRIBE HERE: