On the 4th of November one of Spain\u00b4s largest IT consultancies was hit by ransomware. The employees were told to keep their computers turned off and the company disconnected the network to its clients. Some of their customers cut the connections from their side as well, just to be on the safe side.<\/p>\n
Imagine being one of those customers that morning. Your own systems might be fine, but the people who run them can\u00b4t work, the connections are cut and you don\u00b4t know if the attacker came through to you as well.<\/p>\n
For management this is the question: What is our plan when our provider is the one that gets hit? Most incident response plans assume that we are the victim and that the provider helps us. Very few cover the opposite.<\/p>\n
A few things to think about. Do we know which providers have access to our network and how? Can we cut them off quickly without stopping our own business? Who decides that, and do they have the authority in the middle of the night? Can we run the critical systems ourselves for a week? And does the contract say that the provider must inform us immediately, even before they know the full extent?<\/p>\n
Run an exercise where your most important provider is down and possibly compromised. It is a cheap way to find out what you don\u00b4t know.<\/p>\n
Your supply chain is part of your attack surface, whether you like it or not.<\/p>\n","protected":false},"excerpt":{"rendered":"
On the 4th of November one of Spain\u00b4s largest IT consultancies was hit by ransomware. The employees were told to keep their computers turned off and the company disconnected the network to its clients. Some of their customers cut the connections from their side as well, just to be on the safe side. Imagine being […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,33,41],"class_list":["post-1052","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-incident-response","tag-service-providers"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1052"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1052\/revisions"}],"predecessor-version":[{"id":1064,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1052\/revisions\/1064"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}