How to protect your supply chain from cybercrime

As companies grow and start to work with more clients and link up with more partners, they can suddenly find themselves in the middle of a complex supply chain.

With each new link, the greater the likelihood that a cybercriminal will find a route into not just one company's system, but the whole network of businesses. While a burglar trying several windows and doors can only rob one house if he finds find an unguarded opening, a cybercriminal may use a single breach to rifle through the possessions of all the interconnected neighbours too.

So having a complicated supply chain – or simply being a cog in someone else's – demands paying a lot of attention to IT security.

Just ask Citroen. Like any car manufacturer, its supply chain is long and complex, and it only took an ecommerce partner to have a vulnerability in its software recently for the car maker to suffer an embarrassing public breach, which ran the risk of its customer records falling in to the wrong hands.

For Ramses Galego, international vice president at IT trade body ISACA, such cases should serve as a reminder to companies of all sizes that security is vital – not just to protect themselves, but to be a trustworthy partner. "People often think that their risk of being hacked depends on what they do but when you work with a long supply chain that risk is extended to every partner," he says.

"That's one of the reasons why BMW and Mercedes are said to be taking on more IT engineers than automotive engineers. They're building huge data centres but they then have to ensure the way data is collected and stored is well governed throughout the whole supply chain," says Galego.

By holding valuable IP and customer data on its systems and setting up which partners should have access to which sensitive information, such large enterprises have to devote a huge amount of resources to protecting trade secrets and customer information. For the average SME, of course, the lengths a large company can go to in protecting data is way beyond their skill set, let alone their IT budget.

"Ideally, you need to know what everyone in your supply chain is doing by sending your people to make sure you're happy with every partner's security systems," says Galego.

"That's not always possible for an SME so many will choose to work with a trusted IT supplier who can make their system secure and check out their partners' operations too. If you're too busy or don't know what you're doing, that's just not good enough, you need to send someone out there to do it for you."

Being secure

Top tips for shoring up the defences of a long supply chain revolve around the same commonsense principles that make your own systems less vulnerable to attack. If each party deploys a good level of security, the theory is that there will be no weak link in the chain, says Chris England, director at access management company Okta.

"To begin with, it's a good tip for companies to not rely solely on passwords but use multifactor authentication – such as mobile applications or SMS text messages services which provide a unique security code each time a person logs in," says England.

He adds: "It's also important to understand who has access to applications and data, where they are accessing it and what they are doing with it. So solutions that allow organisations to manage and audit access across the supply chain is a step in the right direction.

"Another way is to provide a single-access point to all applications, such as a centralised portal. This enables businesses to quickly, easily and automatically manage all customer and partner access to data through a single gateway which they will find easier to defend than multiple access points throughout the supply chain."

Keep data safe

Similarly, security expert Paul Dignan, global technical account manager at F5 Networks, advises SMEs to concentrate on securing their systems through some commonsense security measures, as well as working with experts who know what to protect systems from.

"You have to keep your data where you know it's safe, in your data centre and not on hard drives in locations where it could be stolen or cloned," he says.

"Another tip is to make it as difficult as possible for users to copy the data by restricting use of USB or other recording media capabilities. You also need to protect applications against attack. This requires an understanding of each application's functionality to ensure that data cannot be extracted through exploits, such as SQL injection."

Experts protect IP

Techniques, such as SQL injection, are commonly used by hackers and can grant access to databases just by typing code into text entry boxes on web site forms. For the average SME, the skills to carry out the advice passed on by security experts will probably not be readily available. However, knowing what needs to be done can form the basis of a conversation in picking out an IT security provider.

It is important to get this right because the business landscape is littered with examples of companies who experienced embarrassing breaches; which led to valuable data going missing or confidential customer information being leaked.

"Some of the largest names in the car industry have had very high-profile cases of design cloning in recent years," says Dignan.

"Two very well-known brands have recently undertaken litigation to try to enforce design copyright which, though nobody knows for sure, may have come from security breaches leading to features being cloned. As we move to an ever more globalised economy with organisations using parts and labour supplied from all over the world, without sufficient controls, these incidents are bound to become more commonplace."

So, being a good partner now goes far beyond providing a good service; it extends to being a good corporate cyber citizen who does not let down the entire supply chain down by leaving the IT equivalent of an open window for cyber criminals to get in and compromise the network of collaborating companies.

Sponsored content

This content has been sponsored by BIS, whose brand it displays. All content is editorially independent.

Sign up to become a member of the Guardian Small Business Network here for more advice, insight and best practice direct to your inbox.