May 6, 2024 at 07:57PM
Supply chain breaches rose steeply in 2023, with 15% involving third parties, up from 9% in 2022. Verizon’s DBIR considers not only vendor compromises but also vulnerabilities in third-party software. Exploited vulnerabilities, primarily in ransomware attacks, were the most common issue, prompting the suggestion to assess vendor choices and prioritize stronger security measures.
Based on the meeting notes, the key takeaways are:
– Breaches resulting from third-party vulnerabilities have increased significantly, with a 68% rise last year due to software vulnerabilities exploited in ransomware and extortion attacks.
– Supply chain breaches have been on the rise, with 15% of all breaches in 2023 involving a third party (compared to 9% in 2022), and this rise has been attributed to accounting as well as attacking factors.
– The definition of “supply chain breach” has been expanded to include compromises through vendors, data custodians, software updates, and vulnerabilities in third-party software.
– Exploited vulnerabilities were the most common action tracked in the supply chain metric, followed by backdoors/command-and-control (C2) and extortions.
– There is a shift towards considering CVEs (Common Vulnerabilities and Exposures) as a supply chain issue, with a focus on vendor management and making better choices to avoid rewarding the weakest links in the chain.
The meeting notes highlight the need for organizations to take a holistic approach to addressing vulnerabilities and making better choices in vendor management to improve security posture and discourage weak links in the supply chain.