編者按：大數據時代供應鏈在加速的數字化，使得原有的供應鏈管理模式產生顛覆性變革，在營銷拓展、生產製造、運營服務、資源整合等供應鏈環節都在邁向自動化與集成化。隨著供應鏈透明度的不斷提升，供應鏈也逐漸成為網絡攻擊的重點目標。儘管企業在網絡安全上的投入越來越多，但是網絡和系統之間相互連接的相關風險日益嚴重。“一切即服務”不僅消除了傳統的安全邊界，同時也打開了企業無法識別處理新型網絡攻擊的大門。因此，企業該如何規避供應鏈網絡安全風險？本期跟大家分享幾個供應鏈網絡安全方面的資訊。作者：王國文博士
供應鏈的數字化呼喚網絡安全意識 - 從NotPetya襲擊事件看供應鏈網絡安全問題
1、2018年供應鏈網絡安全威脅可能上升
“NotPetya”網絡襲擊是2017年最大的網絡安全事件之一，這一事件重創了航運巨頭馬士基集團，導致馬士基關閉了全球4個國家的76個港口碼頭的運營。這次襲擊直接導致馬士基相關業務持續數週的延誤和中斷，損失有200多萬美元。
據博思艾倫諮詢公司的研究，這種類型的網絡攻擊並不是非持久性的偶然問題。在其2018年特別報告中，博思艾倫公司做出預測，未來一年，企業將會看到更多諸如此類的網絡威脅。
與其他網絡安全襲擊不同的是，“NotPetya”的源頭不在馬士基內部，而是來自於對烏克蘭稅務軟件的攻擊。之後，通過被破壞的網絡進行傳播。博思艾倫將這些類型的網絡安全風險事件描述為“間接性供應攻擊”，即網絡犯罪分子滲透到為大企業供應、運營商服務的小型軟件內。這種網絡攻擊最終的目標不是大企業供應鏈上的供應或運營公司，而是更大的財富500強企業。
有興趣的讀者可以閱讀以下原文：
Supply chain cybersecurity threats may rise in 2018One of the biggest cybersecurity stories of 2017 was the NotPetya attack, which memorably hit shipping giant A.P. Moller - Maersk, causing it to shut down operations at 76 port terminals in four countries around the world. The attack caused delays and disruptions that lasted weeks and ultimately cost the company more than US$2 million.According to the consulting firm Booz Allen Hamilton, this type of cyberattack should not be viewed as a one-time fluke. In its "Foresights 2018" special report, Booz Allen predicts that companies will see more of these types of cyberthreats in the coming year.What made NotPetya different from other cybersecurity attacks is that it originated not with Maersk but as an attack on the Ukrainian tax software M.E.Doc, which then spread through compromised networks. Booz Allen describes these types of cybersecurity risks as "indirect supply attacks," where cybercriminals infiltrate a small software provider or other supplier that operates within the supply chain of a much larger company. The ultimate target is not the original compromised company but larger Fortune 500 companies.Another cybersecurity trend that supply chain managers should be aware of is extortion attacks on industrial control systems (ICS). In these cases, hackers gain access to a manufacturer's ICS and demand that the company pay a ransom to prevent or mitigate any disruptions to operations. Automakers Nissan and Renault and pharmaceutical company Merck all experienced such attacks in 2017. In addition, there have been incidents of Eastern European criminals who have used such techniques against chemical manufacturing facilities, according to the report.However, the report suggests that these types of threats will not be widespread. To successfully carry out such attacks, criminals will need to know not only how to gain access to a control system but also how to target the process being controlled. "Attacks of this nature will likely be beyond the reach of most cybercriminals and be limited to a small, niche group of technically savvy actors," says the report.文章來源：Supply Chain Quarterly2 為何供應鏈安全應是企業間強有力的
紐帶
最近英國國家計算機安全中心（NCSC）報告強調了英國公司普遍存在的一種認同——企業的網絡威脅持續增長。安全部門可能已經對這些潛在風險著手防範，然而，一個能夠掌控安全威脅整體狀況表的政府機構（NCSC）發出聲音，這就意味著企業應該高度重視了。
NCSC認為供應鏈威脅應作為一個新興問題被強調。字裡行間，這是一個警示，不僅表示英國企業將會遭受更多網絡安全問題，當然，英國當局也會出臺大量的應對計劃。
公司將非核心職能外包量的增加，為網絡安全威脅的增長創造了肥沃的土壤。沒有什麼比技術外包更能體現網絡安全的趨勢了。目前由MSPs（並行存儲器）處理的大量敏感的企業數據任務，對關鍵系統的訪問權限是一個特別值得關注的領域。它僅需要一個後門程序，一個不安全的遠程連接，甚至是一個粗心員工，你的數據信息就會悄悄洩露。
考慮到這一點，企業要採取什麼行動來提高其網絡安全性呢？對供應鏈上分散的供應商管理是一個需要解決的問題，這就不僅僅是上面提到的技術問題了。應該是任何一家大企業與其外部企業進行貿易往來過程中流程和觀念的轉變。
首先,評估風險。您已經瞭解了您的關鍵資產是什麼，因此映射出具有哪些潛在的網絡攻擊風險，並對這些風險進行優先級排序。在任何地方，供應商都有進入敏感數據的網關，或者如果你作為技術人員正在實施監管，那麼你就需要更具創造力的，運用攻擊者的思考方式來考慮這些問題。
其次,要有創造力。同時，技術團隊對如何維護其數據安全性要有一個嚴格的把控，但這也可能會讓一些其他業務功能共享公司信息的方式對網絡安全形成潛在風險。
只有在這一階段之後，你才能對當前的企業數據曝光有一個全面的瞭解。與供應商緊密合作，溝通一套應用於網絡安全交互的標準。重要的是，這不是以強制的方式進行的，因為供應鏈上的中小企業會認為這是非常耗時和困難的而不予以配合，所以更重要的是要幫助他們認識到共同的風險在哪裡。出於這個原因，這些標準的制定應該要充分考慮鏈上供應商的資源，從而體現足夠的靈活性。
最後，將這個過程加入到所有未來的供應商中。然而，評估風險的前期工作是非常密集的，而在未來的合同中建立相關標準意味著它成為了你做生意的一部分。這可以使合同生效時相應網絡風險降到最小。
有興趣的讀者可以閱讀以下原文：
Why Supply Chain Security Should be a Strong LinkThe recent NCSC report underlines an all-too-common refrain for UK PLC – the cyber-threat to businesses is growing. The security sector may have grown a thick skin to such warnings, however to hear it from a Government body with access to a unique picture of the threat landscape, means companies should take heed.There was a third emerging problem which NCSC saw fit to highlight, which is that of supply chain threats. Reading between the lines, this is a warning that not only should the UK expect a higher volume of attacks, but also ones with an increased amount of planning.The increased outsourcing of non-core company functions has created fertile ground for the growth of this threat. Nowhere is this trend more evident than with technology outsourcing. The raft of sensitive enterprise data tasks now handled by MSPs with privileged access to critical systems is a particular area for concern. All it takes is a single backdoor, an insecure remote connection or even a rogue employee and your data can quietly walk out the door.Given this, what can companies do to sharpen up their approach? The management of a disparate set of suppliers is a problem that takes more than just technology to resolve. It should be a procedural and cultural shift in the way any large business does business with the outside world.Firstly, assess risk. You will already understand what your critical assets are, so map which have exposure to such attacks and prioritize these. Anywhere that suppliers have a gateway into sensitive data, or control systems if you are overseeing an infrastructure asset, needs to be considered. Think like an attacker, be creative.Once this is captured, a small focused group could be appointed with a broad range of skills that sits outside the purely technical, for example representatives from legal and procurement. Working with this team, assess current suppliers and review the security posture of each and where they have access to networks or data.Again, be creative. Whilst technical teams will often have a tight grasp of how their data is secured, this may throw up some eyebrow raising moments from how other business functions share company information.Only after this phase will you have a full view of current exposure. Work closely with suppliers to communicate a set of standards which need to be applied to secure interactions. It is important that this is not done in a dictatorial way, as the smaller businesses that make up your supplier base can see this as time-consuming and difficult, so helping them understand the shared risk is important. For this reason, these rules should be flexible based upon resource supplier-side.Finally, bake this process into all future supplier on-boarding. Whilst the up-front work to assess risk is intensive, building standards into future contracts means it becomes part of the way you do business. This will minimize exposure from the very start of all engagements.However, it is important not to become complacent. The standards created should be agile enough to respond to emerging attacks and the fluid nature of technology brought into your organization. All security policies date. In addition, security teams should also ensure threat monitoring technology is augmented to watch for supply chain risk, monitoring network traffic for data exfiltration and automating management of shadow IT and software.On the face of it, the supply chain risk can seem daunting. Security teams see managing their own estate as a game of continually plugging different holes, so the thought of having to do so across the entire supplier base looks like a tall order. However, with the right processes, close communications with suppliers and some small technical improvements, it doesn’t have to be. It is a risk point that needs to be considered, not least because your adversaries probably already are. 文章來源：https://www.infosecurity-magazine.com3、供應鏈的網絡安全：誰才是真正的風險，人還是機器？
全球供應鏈的數字化轉型給我們帶來了令人驚歎的創新體驗：複雜的大數據存儲，人工智能的存在，物理和雲的連接，預測分析的出現，網絡消費，網絡採購，物流效率的跨越式提升等。
儘管我們對已在全球供應鏈專業人員日常運營中實施的技術感到驚歎，但我們卻忽視了技術帶來的潛在供應鏈風險。
正如美國國家標準與技術研究所（NIST）發佈的網絡供應鏈風險管理最佳實踐的會議資料裡所描述的，“網絡安全絕不僅僅是一個技術問題，它是一個人、過程和知識問題。”
在Digtial Guardian最近的一篇文章中描述，通過對23名信息安全專家進行了採訪，並提出相應的意見建議，以避免遭受商業、供應商和第三方的網絡供應鏈風險。
從專業人士的建議中主要呈現出包括風險評估、IT安全解決方案、國際標準認證三個主題。
有興趣的讀者可以閱讀以下原文：
The Cyber Security of Supply Chains: Who’s the real risk, Man or Machine?The digital transformation of the global supply chain has brought us mind-boggling innovations: complex big data storage, artificially intelligent beings, a connection of the physical and cloud, an emergence of predictive analytics, e-purchasing, e-sourcing, a transcendence of logistical efficiency and much more.While we marvel at the technology that has been implemented into the day-to-day operations of supply chain professionals globally, we quickly lose sight of the potential supply chain risks tech adds to the equation.As stated in the,Best Practices in Cyber Supply Chain Risk Management Conference Materials,published by the National Institute of Standards and Technology (NIST),“Cybersecurity is never just a technology problem, it’s a people, processes and knowledge problem.”The more individuals involved in the process of digitally enhanced supply chain activities, the more that cyber-based system has opened itself up to potential for cyber security risks.And, it’s not just the individuals in your internal supply chain management teams. It’s vendors, suppliers, manufacturers, delivery specialists, retailers, traders, and the list goes on. From c-suite executives to on-the-floor cashiers, the interconnectivity of supply chain technology involves many individuals from all over the world; bearing different backgrounds, different levels of technological ability, different competencies, and different aspirations.In a recent article by Digtial Guardian, interviews of 23 information security experts were compiled to provide their tips and suggestions for avoiding cyber supply chain risks across business, suppliers and third parties.Compliance and Governance of suppliers, vendors, third-party actors, partners, traders, manufacturers and contractors. Christopher Roach, the managing Director and National IT Practice Leader at CBIZ suggests to continuously assess risks of actors involved in the sharing of cyber-based information, hold all parties to a clear standard level and prepare incident response plans accordingly (digitalgaurdian 2017). Developing security levels is highly dependent on building foundations of trust and transparency. This is developed by collaboration, training and the acceptance of the compliance hierarchy- involving actions such as, supplier auditing and supplier evaluation.Presence of Robust IT security solutions internally is a method of “establishing clear and limited access guidelines for supply chain vendors are a company’s greatest defense against cyber attack. Ensuring these defense mechanisms are in place and continually monitored is critical to the protection of both business and vendor data and continued productivity.” As best put by Daniel Cohn (digitalgaurdian 2017).Certification of International Standards is probably one of the often-overlooked elements of ensuring cyber security in business operations. Achieving and bearing certifications of ISO standards such as ISO 27001 represents a level of competency, and provides a point-of-reference for the proper handling of information security. ISO certifications and standards are, however, guidelines for conducting management systems. Adoption of ISO standards must be treated with a level of relevancy, flexibility and agility.文章來源：https://medium.com- END -
分享到:
閱讀更多 供應鏈管理通訊 的文章
