Thee risee of cyberr threatss too supplyy chainss amidd ......May 21, 2020 · The assessment...
2
Growing cyber threats amid COVID-19 can be a menace to supply chains T The e rise e o of c cyber r threats s to o supply y chains s amid d COVID- -1 19 A weekly high-level brief that focuses on some of the most current cyber threats and trends as idenƟfied by DeloiƩe Cyber Threat Intelligence (CTI), with near-term recommendaƟons on managing cyber risks to respond, recover and thrive through the COVID-19 global pandemic. r Issue 1 | May 21, 2020 Cyber vulnerabiliƟes in supply chain are on the rise The root cause | MiƟgaƟng risk in OperaƟonal Technology (OT) environments during the Ɵme of COVID-19 4 in 10 M Manufacturers Surveyed indicated that their operaƟons were affected by a cyber incident in the past 12 months* Between 2017 and 2018 cyber incidents increase by 3 3.5x Ransomware 2 2.5x Spoofing 0 0.7x Spear-phishing $330,000 Average financial impact from an loT-focused cyber incident $7.5M Average financial impact from a data breach in 2018 87% Unauthorized access 86% OperaƟonal disrupƟon 85% Intellectual property theŌ Manufacturing industry consistently featured a among g the e m most t frequently y t targeted d industries M Major r cyber r risks P Phishing g campaigns s impact t our r well- -k known n shipping g c companies s I Impact t reach: : All| | Geographies: : Global B Business s Email l Compromise e (BEC) ) result t in n fraudulent t f financial l transfers s I Impact t reach: : All| | Geographies: : Global O OT T system m characteristics* C Cyber r concerns T The e complexity y of f I T T and d OT T c convergence • OT is typically managed by engineering, automaƟon, and operaƟons rather than IT. • There is generally no single team responsible for all OT systems and underlying security. • TradiƟonal applicaƟon of security controls such as patching or vulnerability scanning cannot usually occur without detailed evaluaƟon. • Deep knowledge of the industrial processes, technology assets, network architectures, risks, and security approaches are oŌen essenƟal, leading to the need for integrated teams across both IT and OT working together. U Update e paradox • No single approach for patching or updaƟng systems is possible. This can make it difficult to be responsive when vulnerabiliƟes are detected, oŌen driving the need for defense-in-depth approaches to be adopted. L Legacy y system m setbacks • Many systems have long life cycles (10+ years) and were not built to be externally connected. With the increase in edge compuƟng, cloud plaƞorms, and the adopƟon of other smart factory technologies, air gapping is no longer a viable opƟon. D Destabilized d infrastructure • Older equipment oŌen uses proprietary communicaƟon protocols that can be easily disrupted if data communicaƟon within the network segments increases. • ExisƟng networks and associated architectures were not designed to handle the data flows required for the adopƟon of these new technologies. • There are limited veƫng processes to understand the security risks associated with new technologies being acquired and deployed – increasing the risk of an aƩack affecƟng both this new technology and other legacy technologies on the same networks. O Operational l constraints • Real-Ɵme capabiliƟes are typically essenƟal; introducing addiƟonal security controls could introduce latency. • Making network or other changes could require downƟme or an outage. DownƟme due to maintenance should be limited to absolute minimums. • SoŌware updates are oŌen not possible due to the proprietary nature of products or contracts or equipment age. • Establishment of clear responsibiliƟes across funcƟons (IT and OT) can be crucial. It is important to approach addressing cybersecurity risks using cross-funcƟonal teams, considering what each group does well. *Source: Cybersecurity for smart factories In April 2020, DeloiƩe CTI observed two phishing campaigns and one malware using COVID-19 lures. These COVID-19 phishing campaigns impersonated well-known shipping companies such as FedEX, DHL, and UPS, as well as, targeted US-based medical providers with malicious aƩachments. Gaining a beƩer understanding of how supply chains are changing in light of this global pandemic could help retailers and other businesses secure, adapt, and move ahead following this incredibly difficult period. In 2019, 40% of manufacturers had their operaƟons affected by a cyber incident. With supply chains already facing risks of shutdown, reduced operaƟons forward in these due to social distancing, and re-tooling operaƟons to make Personal ProtecƟve Equipment, addiƟonal disrupƟons from cyber incidents may have a more severe impact. T This w week w we h highlight t the r rising t threats t targeting e elements o of s supply c chain (and originally idenƟfied in our detailed threat report dated April 22 – April 28). In the past 60 days, there has been an increase in aƩacks to supply chain related to COVID-19, including targeted aƩacks on known organisaƟons (e.g., UPS). Defining security requirements and having a cyber-risk management program to evaluate third- party (and even fourth-party) services can help organisaƟons reduce the risk of aƩacks on their supply chains. In supply chain, we have mulƟple vendors who communicate to each other through email. In Early April 2020, the FBI released a statement indicaƟng an anƟcipated rise in Business Email Compromise (BEC) schemes related to the COVID-19 pandemic. Business Email Compromise aƩacks exploit these relaƟonships to trick one or more vendors into wiring money to the malicious aƩackers. According to the FBI, BEC aƩacks cost organisaƟons approximately $1.77 Billion USD in losses in 2019. Companies conducƟng business with foreign enƟƟes are more suscepƟble to BEC aƩacks as their employees might fail to recognize unusual business behavior exhibited by a foreign supplier. On April 15, 2020, DeloiƩe CTI observed mulƟple spam campaigns against businesses conducƟng Business Email Compromise aƩacks using Coronavirus (COVID-19) themes. In these aƩacks, the aƩacks used COVID-19 themed emails such as payroll, wire transfer, or legal aƩenƟon social engineering themes requesƟng their targets make fraudulent financial transfers. As many leading manufacturers raced globally to do their part to produce criƟcal COVID-19 supplies such as personal protecƟve equipment and venƟlators, even new vaccines, they may become targets of theŌ or extorƟon by cyber adversaries looking to exploit vulnerabiliƟes that could lead them to valuable intellectual property. The potenƟal for damage in an operaƟons environment can dramaƟcally affect revenue and may shut businesses down completely. Managing risk across an extended supply chain is oŌen challenging. For large companies, there might be thousands of different third, fourth, and fiŌh parƟes that they have to consider. Whether it’s a supplier that embeds something into a subcomponent, or a soŌware product. With more connected components, communicaƟng and storing data, the risk rises, and the aƩack surface is expanded. This Ɵme of uncertainty caused by the novel coronavirus has shown us that we aren’t quite as prepared for “anything” as we thought. There are many areas where people, process, and technology overlap between the IT and OT ecosystems. The below highlights the top cyber concerns that manufacturers should be aware of as they look to converge IT and OT across their operaƟons.
Transcript of Thee risee of cyberr threatss too supplyy chainss amidd ......May 21, 2020 · The assessment...
Growing cyber threats amid COVID-19 can be a menace to supply chains
TThee risee oof ccyberr threatss too supplyy chainss amidd COVID--119A weekly high-level brief that focuses on some of the most current cyber threats and trends as iden fied by Deloi e CyberThreat Intelligence (CTI), with near-term recommenda ons on managing cyber risks to respond, recover and thrivethrough the COVID-19 global pandemic.
r
Issue 1 | May 21, 2020
Cyber vulnerabili es in supply chain are on the rise
The root cause | Mi ga ng risk in Opera onal Technology (OT) environments during the me of COVID-19
4 in 10MManufacturers
Surveyed indicated thattheir opera ons wereaffected by a cyber incidentin the past 12 months*
Between 2017 and 2018cyber incidents increase by
33.5x Ransomware22.5x Spoofing00.7x Spear-phishing
$330,000Average financial impactfrom an loT-focusedcyber incident
$7.5MAverage financial impactfrom a data breach in 2018
87%Unauthorized
access
86%Opera onaldisrup on
85%Intellectual
property the
Manufacturingindustry consistentlyfeatured aamongg thee
mmostt frequentlyy ttargetedd industries
MMajorr cyberr risks
PPhishingg campaignss impactt ourr well--kknownn shippingg ccompaniess IImpactt reach:: All|| Geographies:: Global
BBusinesss Emaill Compromisee (BEC)) resultt inn fraudulentt ffinanciall transferss IImpactt reach:: All|| Geographies:: Global
OOTT systemm characteristics* CCyberr concerns
TThee complexityy off ITT andd OTT cconvergence
• OT is typically managed by engineering, automa on, and opera ons rather than IT.• There is generally no single team responsible for all OT systems and underlying security.• Tradi onal applica on of security controls such as patching or vulnerability scanning cannot usually occur without detailed
evalua on.• Deep knowledge of the industrial processes, technology assets, network architectures, risks, and security approaches are
o en essen al, leading to the need for integrated teams across both IT and OT working together.
UUpdatee paradox • No single approach for patching or upda ng systems is possible. This can make it difficult to be responsive whenvulnerabili es are detected, o en driving the need for defense-in-depth approaches to be adopted.
LLegacyy systemm setbacks • Many systems have long life cycles (10+ years) and were not built to be externally connected. With the increase in edgecompu ng, cloud pla orms, and the adop on of other smart factory technologies, air gapping is no longer a viable op on.
DDestabilizedd infrastructure
• Older equipment o en uses proprietary communica on protocols that can be easily disrupted if data communica on withinthe network segments increases.
• Exis ng networks and associated architectures were not designed to handle the data flows required for the adop on ofthese new technologies.
• There are limited ve ng processes to understand the security risks associated with new technologies being acquired anddeployed – increasing the risk of an a ack affec ng both this new technology and other legacy technologies on the samenetworks.
OOperationall constraints
• Real- me capabili es are typically essen al; introducing addi onal security controls could introduce latency.• Making network or other changes could require down me or an outage. Down me due to maintenance should be limited
to absolute minimums.• So ware updates are o en not possible due to the proprietary nature of products or contracts or equipment age.• Establishment of clear responsibili es across func ons (IT and OT) can be crucial. It is important to approach addressing
cybersecurity risks using cross-func onal teams, considering what each group does well.
*Source: Cybersecurity for smart factories
In April 2020, Deloi e CTI observed two phishing campaigns and onemalware using COVID-19 lures. These COVID-19 phishing campaignsimpersonated well-known shipping companies such as FedEX, DHL, andUPS, as well as, targeted US-based medical providers with maliciousa achments.
Gaining a be er understanding of how supply chains are changing in light of this global pandemic could help retailers and other businesses secure,adapt, and move ahead following this incredibly difficult period. In 2019, 40% of manufacturers had their opera ons affected by a cyber incident. Withsupply chains already facing risks of shutdown, reduced opera ons forward in these due to social distancing, and re-tooling opera ons to makePersonal Protec ve Equipment, addi onal disrup ons from cyber incidents may have a more severe impact. TThis wweek wwe hhighlight tthe rrising tthreatsttargeting eelements oof ssupply cchain (and originally iden fied in our detailed threat report dated April 22 – April 28).
In the past 60 days, there has been an increase in a acks to supply chain related to COVID-19, including targeted a acks on known organisa ons (e.g., UPS). Defining security requirements and having a cyber-risk management program to evaluate third-party (and even fourth-party) services can help organisa ons reduce the risk of a acks on their supply chains. In supply chain, we have mul ple vendors who communicate to each other through email. In Early April 2020, the FBI released a statement indica ng an an cipated rise in Business Email Compromise (BEC) schemes related to the COVID-19 pandemic. Business Email Compromise a acks exploit these rela onships to trick one or more vendors into wiring money to the malicious a ackers. According to the FBI, BEC a acks cost organisa ons approximately $1.77 Billion USD in losses in 2019. Companies conduc ng business with foreign en es are more suscep ble to BEC a acks as their employees might fail to recognize unusual business behavior exhibited by a foreign supplier.
On April 15, 2020, Deloi e CTI observed mul ple spam campaignsagainst businesses conduc ng Business Email Compromise a acksusing Coronavirus (COVID-19) themes. In these a acks, the a acksused COVID-19 themed emails such as payroll, wire transfer, or legala en on social engineering themes reques ng their targets makefraudulent financial transfers.
As many leading manufacturers raced globally to do their part to produce cri cal COVID-19 supplies such as personal protec ve equipment and ven lators,even new vaccines, they may become targets of the or extor on by cyber adversaries looking to exploit vulnerabili es that could lead them to valuableintellectual property. The poten al for damage in an opera ons environment can drama cally affect revenue and may shut businesses down completely.Managing risk across an extended supply chain is o en challenging. For large companies, there might be thousands of different third, fourth, and fi h par esthat they have to consider. Whether it’s a supplier that embeds something into a subcomponent, or a so ware product. With more connected components,communica ng and storing data, the risk rises, and the a ack surface is expanded. This me of uncertainty caused by the novel coronavirus has shown usthat we aren’t quite as prepared for “anything” as we thought. There are many areas where people, process, and technology overlap between the IT and OTecosystems. The below highlights the top cyber concerns that manufacturers should be aware of as they look to converge IT and OT across their opera ons.
Shahil Kanjee+27 11 806-5353 skanjee@deloi�e.co.za
Eric Mc Gee+27 11 517-4715 erimcgee@deloi�e.co.za
Cathy Gibson+27 11 806-5386 cgibson@deloi�e.co.za
Deloi�e refers to one or more of Deloi�e Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related en��es. DTTL and each of its member firms are legally separate and independent en��es. DTTL (also referred to as “Deloi�e Global”) does not provide services to clients. In the United States, Deloi�e refers to one or more of the US member firms of DTTL, their related en��es that operate using the “Deloi�e” name in the United States and their respec�ve affiliates. Certain services may not be available to a�est clients under the rules and regula�ons of public accoun�ng. Please see www.deloi�e.com/about to learn more about our global network of member firms.
This communica�on contains general informa�on only, and none of Deloi�e Touche Tohmatsu Limited (“DTTL”), its global network of member firms or their related en��es (collec�vely, the “Deloi�e organiza�on”) is, by means of this communica�on, rendering professional advice or services. Before making any decision or taking any ac�on that may affect your finances or your business, you should consult a qualified professional adviser. No representa�ons, warran�es or undertakings (express or implied) are given as to the accuracy or completeness of the informa�on in this communica�on, and none of DTTL, its member firms, related en��es, employees or agents shall be liable or responsible for any loss or damage whatsoever arising directly or indirectly in connec�on with any person relying on this communica�on. DTTL and each of its member firms, and their related en��es, are legally separate and independent en��es.© 2020. For informa�on, contact Deloi�e Global
Recover and Thrive | Securing supply chain for the “next normal” – Spotlight on smart factories
As manufacturing organiza�ons evolve processes and protocols amid COVID-19, they should invest in aholis�c cyber management program that extends across the enterprise (IT and OT) to iden�fy, protect,respond to and recover from cybera�acks. Specifically, the following four steps should be consideredwhen star�ng the process of building an effec�ve manufacturing cybersecurity program:
Prioritize actions based on risk profiles and demand amid COVID-19. Use the results of the cybersecurity maturity assessment to create a strategy and roadmap that can be shared with execu�ve leadership and, where appropriate, the board to address risks that are commensurate with your organisa�on’s risk tolerance and capabili�es.
Perform a cybersecurity maturity assessment onnew technology developed. With every new usecase in pilot or produc�on within the smartfactory, there come new exposures to threats.The assessment should include OTenvironments, business networks, andadvanced manufacturing cyber risks such as IPprotec�on, control systems, connectedproducts, and third-party risks related toindustrial ecosystem rela�onships.
Establish a formal cybersecurity governanceprogram that considers the evolution of OT inresponse to COVID-19. Business-centricrepresenta�on in these governance structuresis important to allow IT and OT teams tocollaborate where prac�cal and manage thebusiness. The manufacturing security teamsshould work closely with the site to considerthe risks and appropriate mi�ga�on strategies.
Build in security to COVID-19 related technologytransformation. Since many smart factory usecases are s�ll in planning and early stages, nowis the �me to harmonize these projects withyour cyber risk program. Design and includethe appropriate security controls at the frontend of these projects. Important controls toconsider include use of secure networksegmenta�on models, deployment of passivemonitoring solu�ons, secure remote access,control of removable media, improvedmanagement of privileged access, andexecu�ng consistent backup processes.
Deloi�e Cyber drives progress in a dynamic, connected world, solving complex problems to build confident futures. Using human insight, technological innova�on, and comprehensive cyber solu�ons, we manage cyber everywhere, so society - and your organisa�on - can thrive anywhere.
We’re by your side to help you through COVID-19
