How to assess and gain confidence in your supply chain cyber security

Maintaining a regular dialogue with your suppliers so they inform you of changes will help ensure standards are maintained, and identify any issues that need addressing. During these regular cyber security reviews, you could gather the following information from your supplier:

• List of supplier assets that are being used by your organisation.
• Attacks or breaches they have suffered.
• Confirmation that they actively manage, monitor and regularly audit any system or service accounts they use to gain access to your systems, services and information.
• KPIs showing metrics regarding security performance, including software that is being patched, breach events, intrusion detection systems output, firewall output.
• Results of recent assurance activities of its own suppliers.
• How often is the supplier’s incident response plan reviewed?
• When was the supplier last visited?

Examining your own organisation’s assets is also a good way to confirming supplier security is being maintained. This might include:

• Checking that suppliers' privileged accesses are being used as expected.
• Monitoring systems and services to detect unauthorised accesses, external connections, remote access and data exfiltration.
• Keeping a list of approved network connections (such as site to site VPNs) between your corporate network and third parties, and monitoring network connections to ensure that only authorised connections exist.
• Conducting penetration tests of the shared organisation/supplier infrastructure.

Consider using third party tools to continuously monitor your suppliers.

There are a range of commercial tools available which can review and access your suppliers' public facing traffic and attempt to make an assessment of vulnerabilities in any of the packets of data being sent. Although this might not represent a precise test of your suppliers' capabilities, the automated and real time nature of the reporting could alert to significant changes, which might prompt a conversation with the supplier concerned.

You may wish to formalise how your supplier demonstrates it is meeting the controls that it has agreed to have in place, as part of any Service Level Agreement. These should be measurable, with automation applied as much as possible. These should be defined in contractual obligations and may include:

• the scope of monitoring to be undertaken
• the expected data set(s) to be collected
• log/data hand-off or shipping mechanisms
• assurances around the integrity and security of the data captured
• how the information will be used
• responses to findings outside defined thresholds
• details of incident management and reporting