NIST Updates Supply Chain Cybersecurity Guidance

The US National Institute of Standards and Technology (NIST) has up-to-date its direction on supply chain cybersecurity.

The revised publication, Cybersecurity Supply Chain Risk Administration Procedures for Systems and Businesses, offers companies key methods to adopt as they handle cybersecurity pitfalls throughout their provide chains. In particular, it advises corporations to consider vulnerabilities in the factors of a completed products they are considering applying, and not just of the merchandise itself. This features the journey individuals components took to get to their destination.

The update comes amid surging source chain attacks, highlighted by latest high-profile incidents like SolarWinds and Kaseya. Past thirty day period, study from the NCC Group found that source chain attacks on international companies amplified by 51% in H2 2021.

The publication was developed as section of NIST’s reaction to President Joe Biden’s executive buy 14028: ‘Improving the Nation’s Cybersecurity,’ which incorporated new needs on security federal federal government software package suppliers.

The assistance is mainly aimed at acquirers and end-buyers of merchandise, software program and expert services. It aims to help these organizations make cybersecurity offer chain risk factors and demands into their acquisition procedures.

One particular of the publication’s authors, Jon Boyens, explained: “Managing the cybersecurity of the source chain is a require that is below to keep. If your company or corporation has not started off on it, this is a thorough tool that can choose you from crawl to walk to run, and it can aid you do so right away.

“A producer might working experience a source disruption for critical production factors due to a ransomware attack at a person of its suppliers, or a retail chain might working experience a info breach because the company that maintains its air conditioning methods has obtain to the store’s info-sharing portal.”

Commenting on the update, Trevor Dearing, EMEA director of critical infrastructure at Illumio, claimed: “It is encouraging to see NIST releasing updated direction acknowledging the raise in cyber-attacks targeting the source chain and the consequent necessity to bolster the supply chain’s cybersecurity.

“We can no for a longer period convert a blind eye to the exponential increase in attacks on the IT systems of manufacturers, logistics corporations and businesses that finally focus on the operational aspect of the small business. The real truth is risk actors have recognized they can boost efficiency and profitability by compromising a single products realizing it will have an impression downstream on companies who use it.

“Moreover, attacks that disrupt the logistics or production process can have rapid true-globe impacts, more increasing the probability any ransom demands will be fulfilled as corporations flounder to get critical units back up and functioning. The consequence is that source chain attacks have increased with a vengeance.”

Some sections of this post are sourced from:
www.infosecurity-magazine.com