Organizations that use services of mainstream software providers continue to face trust issues amid the increase in supply chain and ransomware attacks, a recent report from CrowdStrike revealed.

The 2021 CrowdStrike Global Security Attitude Survey report stated that nearly 63% of respondents lost trust in mainstream software suppliers due to security issues connected with products and services from those vendors. Around 45% of respondents had already sustained a supply chain attack last year.

Rise of Supply Chain Attacks

Recent supply chain attacks on Kaseya and Solarwinds represent the security breaches from vulnerable software resources organizations rely on. Around 84% of IT and security professionals believe supply chain attacks will be one of their most significant cybersecurity threats in the next three years.

“This clearly reinforces the need for organizations to revisit their vetting procedures as well as their recovery strategies. If software supply chain attacks increase as expected, organizations could quickly find themselves in considerable difficulty if they have not prepared for such issues. In response to the recent massive increase in supply chain attacks, businesses must change the way they operate and evaluate more stringently the suppliers they work with. Every supplier, no matter their longevity or reputation, needs to be assessed on a continual basis, and their software monitored with the same impartiality as any other,” the report said.

Ransomware – A Persistent Threat

The report also revealed that ransomware attacks remain a highly pervasive threat, costing organizations nearly $2 million on average. They continue to prove effective, with average ransomware payments increasing 62.7% in 2021, hitting organizations hard with double extortion schemes. It was found that over 96% of organizations that paid a ransom were forced to pay additional extortion fees, costing businesses on average $792,493. Nearly 66% of surveyed organizations suffered at least one ransomware attack in the past 12 months. More than half (57%) of businesses did not have a comprehensive ransomware defense strategy in place.

Commenting on the survey findings, Michael Sentonas, Chief Technology Officer at CrowdStrike, said, “The survey presents an alarming picture of the modern threat landscape, demonstrating that adversaries continue to exploit organizations around the world and circumvent outdated technologies. Today’s threat environment is costing businesses around the world millions of dollars and causing additional fallout. The evolving remote workplace is surely accentuating challenges for businesses as legacy software like Microsoft struggles to keep up in today’s accelerated digital world.

“This presents a clear clarion call that businesses need to change the way they operate and evaluate more stringently the suppliers they work with. The threat landscape continues to evolve at a frightening pace and it’s obvious that modern organizations need a cloud-native, holistic end-to-end platform approach to tackle and remediate threats in a swift manner.”

Mitigation

Explaining on how organizations can mitigate the risks from supply chain attacks, Mark Goudie, APJ services director, CrowdStrike, said, “In terms of mitigating the risk of such attacks, companies need to look internally at a number of areas that they can control. They should ensure their supply chain have the same rigorous security protocols they have themselves but in India only 43% of respondents said they had vetted all of their suppliers for security purposes in the past 12 month. That exposes a significant risk especially as supply chains are growing in size and complexity. It is also eroding trust with 63% of respondents in India saying they had lost trust in a new or existing supplier.

Today’s threat environment and the supply chain attack vector highlights the need for organisations around the world to transform their security and adopt a Zero Trust architecture in order to protect their digital assets, identities and core infrastructure as threat actors are well resourced and becoming more sophisticated. It is important to note that even if a supply chain attack does occur, the victim will be better able to prevent, detect and respond to an incident with EDR technology in place. Threat visibility is key to minimising damage from any form cyberattack no matter whether it is a supply chain or otherwise. Organisations at all levels of the supply chain must work together to ensure they do not collectively become the next victims of nation states and cybercriminals executing supply chain attacks.”

The post Organizations Losing Trust in Security Vendors Amid Rising Cyberattacks appeared first on CISO MAG | Cyber Security Magazine.