Cyber security attacks via third parties, and the software chain, are becoming more commonplace. And, as UK businesses continue to rely heavily on services such as cloud computing, this issue is unlikely to disappear in a flash.
There are several ways that larger businesses can make sure they stay safe, from implementing code integrity checks to closely monitoring software, but these are not always affordable and achievable solutions for SMEs. The good news is, the Switch2IT team has three top tips on how you can help protect your smaller business from falling victim to a strike from a costly third-party cyber security attack…
Action authentication
The reality of using a supply chain is that potential cyber security issues need to be struck out as soon as possible. And, when using third-party service providers, a zero-trust approach must be adopted. Third-party attackers will unlikely access their target system at first try, they will aim to get traction with a target network and then hone in. This means all access requests must be authenticated, from inside and outside the enterprise network, to stop them in their tracks.
We should also mention the pitfalls of human behaviour here. Just because an experienced and “trusted” member of staff is a user, all the verification advice still stands. You might even have someone on your team come up with a “money-saving” alternative, be it an application or piece of kit, which once implemented could let down your defences that you have worked so hard to secure. Be careful what you action – unless it is authentication!
As stated by Kevin Dunne, president at access orchestration solution Pathlock: “A zero-trust model can minimize the damage in the case of a breach by, for example, limiting the ability for hijacked credentials to be used to move laterally, export data, or set up backdoors for future attacks… It can help ensure that users do not have access to applications or privileges they don’t require, and to make sure they are constantly deprovisioned to the least privileged access required”.
Note normalities
A decade ago, your average business had an internal IT infrastructure and full visibility. Now, they likely have the cloud, little or no visibility and are at the mercy of a third-party provider’s cyber security strategy.
In an ideal world, having a good working knowledge of your key software and monitoring for unknowns and glitches is a great way to identify suspicious activities from third-party cyber security attackers.
If your budget allows, system integrity monitoring should be maintained to alert for software updates and patches. While network detection and response tools, as well as endpoint detection and response products, should be used to highlight and target cyber security attacks in their infancy.
However, as Switch2IT’s Managing Director Daniel Piggott says: “Sophisticated monitoring and detection often requires the assistance of AI and large tech budgets – this isn’t always achievable for SMEs. In these circumstances, having your software set to automatically update and deploy patches should be your first port of call. It’s also best to work with an IT support team who can stay abreast of industry changes and potential cyber security threats.”
Watch web apps
Did you know, when a user accesses your web app or website, over 70% of the code that hangs on their browser through JavaScript comes from a third-party such as Google? That code then hits the user’s browser without vetting. Meaning, any compromise to the third party gives cyber security attackers the potential to access a bundle load of information via the browser.
Switch2IT stresses this as the perfect example of where the Computer Misuse Act 1990 needs stricter enforcement to stop malicious actors from launching third-party cyber-attacks. In the meantime, you should strive for a strategy to identify and inventory all third-party and supply chain partners – blocking them when they act out of the ordinary.
Switch2IT: the best defence against third-party cyber security attacks
Offering everything from cloud services from tried and tested cloud service providers to cloud strategies that will help your business prosper, Switch2IT should be your first choice for worry-free technical support.
Not only are we experts when it comes to the cloud, but we are also cyber security specialists. We will combine National Cyber Security Centre (NCSC) recommendations with our own industry knowledge and insight, to help keep your business safe from third-party cyber security attacks. Contact us today for a free, no-obligation consultation.
