Safe Supply Chain in Financial Orgs

Last year, the landscape of the threats in the software supply chain showed how the level of sophistication of these attacks is changing, making them more dangerous. In 2023, sophisticated attacks targeting the banking sector were uncovered. In both attacks, threat actors uploaded malicious packages to NPM, the largest software registry in the world. In the first attack, the package included a payload made to secretly intercept login information and send it to a remote address. In the second attack, the packages contained scripts that, upon installation, identified the operating system of the victim and decoded relevant encrypted files from the packages. Afterwards, the files were used to download a malicious binary onto the victim’s system. The threat actor leveraged the Havoc Framework, which is an advanced post-exploitation command and control framework. This framework enables attackers to manage and evade attacks by bypassing the security measures such as Windows Defender. It’s important to mention that the attacker posed as a bank employee with a fake LinkedIn page associated with the bank, which led to security experts researching the incident to consider that the whole situation could be a penetration test. This demonstrates a clever strategy that attackers can use to trick researchers.

These attacks underscore the sophistication in which malicious actors are carrying out their attacks. Methods are evolving to exploit vulnerabilities in the supply chain, making it imperative for security measures to also evolve into a stronger front. We’ll discuss some best practices and recommendations for those involved with protecting financial institutions. But first, let’s remember what a supply chain attack is.

A supply chain attack is a kind of cyberattack that targets weak links in an company’s network, exploiting vulnerabilities in vendors and third-party suppliers. Threat actors gain access to these systems and use them to launch attacks on the final target, the financial institution in this case. Supply chain attacks are dangerous because they can be very difficult to detect. Organizations may not even be aware that their vendors have been compromised or they may not even have clear visibility of third-party components in their software.

These attacks target trusted suppliers who provide software or services that are crucial to the organization’s supply chain. This could be a supplier, vendor, a customer or a third-party software library that the company is dependent upon. Attackers can tamper with software during the manufacturing or distribution process. They could target a trusted vendor and gain access through a weakness they find. They can steal credentials of the suppliers, or even track vulnerabilities and seek out the organizations that use the vulnerable vendor.

As previously stated, supply chain attacks are becoming more sophisticated and are now targeting new areas with combined tactics. Last year, key trends included:

Due to their complex ecosystems, financial institutions face a diverse range of risks from different entry points. According to a study on trends in supply chain cyber risk management from 2022 to 2023, these are possible cyber risks and their probable entry points:

Thanks to regulatory authorities, companies are pushed to have guidelines that provide specific conditions they must comply with when using a vendor service. For example, PCI DSS published a document called “Information Supplement: Third-Party Security Assurance”. This document outlines the specific PCI DSS requirements applicable to providers. It provides guidance to both the supplier and the company acquiring the service. It also goes through many controls both companies need to have, like secure access control and network security. A responsible use of vendors is also encouraged by other laws and regulations. The California Consumer Privacy Act (CCPA) and the General Data Protection Regulations (GDPR) among others. These laws mandate companies make sure the suppliers they work with adhere to the applicable regulations.

The following recommendations for software supply chain security came from financial institutions experts around the world. They discuss the stages and the recommendations a person in charge of supply chain security should consider when choosing and dealing with a supplier.

Securing the software supply chain is critical for financial institutions to be better prepared and protected against cyber threats.

Managing software supply risks can be enhanced by all of the above. But we would suggest going a step further by hacking continuously. Securing your supply chain goes beyond managing vendor risks. Indeed, the software supply chain security approach includes securing proprietary software, infrastructure and more.