Hackers look to suppliers for access to corporate systems and data

An annual review of incidents worked on by the cyber team at Pinsent Masons (20-page / 4.89MB PDF) has identified a marked increase in the number of cyber incidents in which an intrusion into corporate systems had originated with a cybersecurity breach at a supplier, compared to the previous year.

Julia Varley, a member of the cyber team at Pinsent Masons, said that requiring suppliers to notify cybersecurity incidents they experience is important because of the incident and data breach reporting obligations businesses face, such as in heavily regulated industries like financial services and energy, but also under more general legislation such as the General Data Protection Regulation (GDPR) which sets out strict timeframes for reporting breaches to regulators.

Varley said that Pinsent Masons had also been engaged in work in relation to the SolarWinds and Kaseya cyber attacks, which targeted software supplied to a large number of organisations.

Varley said: “In the SolarWinds incident, attackers inserted malware into software updates. When customers downloaded these updates, they inadvertently downloaded malware onto their systems, which created a backdoor for the attackers to access the customers’ systems and deploy further malware. Similarly, the Kaseya attack involved the leveraging of a vulnerability in Kaseya’s virtual system administrator software which was used by a number of managed service providers to administer their customers’ network. Through this vulnerability, attackers were able to access and encrypt the provider’s end customer systems,” she said.

Growth in compensation claims raised by or on behalf of data subjects, and a rise in the use of malware attacks, and in particular ransomware, was also identified by Pinsent Masons’ cyber team over the past 12 months. The report also identified the use of increasingly sophisticated phishing emails by cyber criminals.

“Some phishing emails are very realistic and authentic,” Varley said. “We have seen attackers use more sophisticated methods of phishing campaigns, through the sending of phishing emails from genuine accounts of organisations in a client’s supply chain. These can be very difficult to identify the threat. However, we continue to see intrusions arising out of phishing emails, which should be much easier to spot, particularly by individuals who have received phishing awareness training.”

“The key to guarding against these types of attack remains largely down to educating employees through methods such as conducting simulated phishing campaigns to raise awareness. In addition, we recommend the use of multi-factor authentication across systems, maintaining robust back-ups, and adopting principles of least-privilege and network segregation to protect against an attacker moving laterally through the IT estate,” she said.