As modern warfare evolves, it’s clear that the Ukraine/Russia conflict will be fought on multiple fronts – both virtual and geographic. The recent halt on the Toyota production lines following a cyber-attack on one of their key suppliers, demonstrates once again that a supply chain is only as a robust as the weakest supplier.
Karla Reffold, COO of Orpheus, the only UK government accredited cyber risk ratings company and a key partner of Achilles, gives an insight into the cyber risks raised as a result of the Russia/Ukraine conflict and what we should watch out for.
What are your initial observations on the implications for cyber security, following the events of recent weeks?
Karla Reffold: So far, cyber attacks accompanying the invasion have been relatively muted – with the isolated use of the WhisperGate wiper malware by Russia the standout example. We’ve also seen plenty of activist operations, though these are unlikely to have lasting consequences; and the spectacular breakdown of the Conti ransomware groups as pro-Ukrainian and pro-Russian members leaked data and sought to expose their former partners in crime.
The seeming lack of state activity may reflect how quickly the situation has developed and the resulting lack of international preparedness. More significantly, it shows the limits of cyber attacks when compared to bullets and bombs on the ground, or the economic and political impact of sanctions – or even activity by large technology companies themselves – for example to cease sales or operations in Russia.
It’s important to understand that this is just the beginning of what looks set to be a long conflict, and sophisticated cyber attacks cannot simply be set up and executed overnight. Just because the international implications have been limited so far, this doesn’t mean it will carry on like this.
It’s a fast moving situation, but what is your advice to businesses watching this situation and wondering how to mitigate supply chain cyber risk in these uncertain times?
Karla: Organisations need to quickly improve their own cybersecurity if they have improvements they can make. Assuming organisations are confident in their own defences, they need to consider their suppliers. Supply chain security is an area where organisations are already behind; threat actors have been exploiting this weakness for some time. As the threat level is now increasing, expediting security in this area is essential.
Companies need to understand the risks from their supply chain, establish a capability that allows for continuous monitoring of the rapidly developing landscape and then work with suppliers to drive improvement. You also need to consider what access a supplier or software has to their own systems, and develop and test scenarios to better prepare your company to respond to a potential incident.
Finally, we’re all consuming a lot of information around this, but what are the issues around cybersecurity that we should watch for over the coming weeks?
Karla: We should all be aware of the situation in Ukraine and the resulting potential for broader cyber attacks coming from Russia – the US government have told organisations to put “shields up.” Beyond understanding the specific threats you and your supply chain face, the key thing is to continue to focus on cyber security fundamentals rather than panic in response to the potential threat.
If you’re worried about cyber risk in your supply chain, Achilles and Orpheus can help. Get in touch to speak to our team of experts.
