Supply chain complexity is driving cyber risk

Cybersecurity risk to global supply chains is increasing.

In October, data collected by the Boston Consulting Group found that the “number, severity, and sophistication” of cyber attacks is growing.

As noted by experts at the Ponemon Institute, the problem is reaching a tipping point. They report that 98% of companies have been negatively impacted by a breach that occurred at a company in their network. Similarly, the Microsoft Digital Defense Report 2023 highlighted that a supply chain attack affected 61% of businesses in the past year.

Supply chain complexity is creating cyber vulnerabilities

The risk of attack, the report notes, is increasing in tandem with the complexity of global supply chains.

As organisations increase the scope and diversity of their supplier networks to boost resilience, the number of network tiers and endpoints also increases, and so do the supply chain’s points of vulnerability.

Globalised supply chains are increasingly “often several tiers deep” notes the BCG report, which adds: For example, an auto manufacturer’s supply chain includes numerous vendors, manufacturers, service providers, and customers that rely on other suppliers, which, in turn, depend on still other vendors. The auto manufacturer’s many suppliers connect to its digital network.” The organisaiton therefore also connects to their vendors’ and customers’ digital networks. Adding another layer of risk, the suppliers connect to the company using an array of hardware and software components which were acquired from and serviced by still more third party vendors.

The upshot is that, in a large, multi-tier supply chain, there are multiple partner entities with varying degrees of proximity to the organisation. However, while the organisation might not have any control over these organisations’ security practices, they nevertheless share in their security risks. “Third parties’ cybersecurity risks are also the company’s risks,” the report notes.

A recent survey of business leaders in Australia conducted by PwC found that more than 75% of respondents believe organisational complexity creates “concerning” cyber risks. However the problem is that “While Australian business leaders have raised concerns that too much avoidable, unnecessary organisational complexity poses concerning cyber and privacy risks, some complexities are necessary,” warns PwC Australia Cybersecurity & Digital Trust Partner Cameron Whittfield.

Managing complexity and cyber risk

Faced with the financial and reputational damage that a supply chain breach can cause, leaders need to find ways to remain resilient in the face of the cybersecurity threats. Complexity is undeniably a driver of risk to the supply chain.

However, faced with the fact that complex supply chains are, in many cases, necessary, organisations need to find ways of protecting themselves from cyber attack without “thoughtlessly streamlining and simplifying operations and processes,” as Whittfield puts it.

“Organisations should consciously and deliberately” simplify where possible, he adds, “to protect its systems and data.” However, simplifying the complexities that can be eliminated, and protecting complex elements of the supply chain that can’t are both significant challenges.

Whittfield argues that collaboration between ecosystem partners and threat intelligence sharing are vital in the process of securing a supply chain. He emphasises that there needs to be “more effective collaboration, within and between the public and private sectors.” Most importantly, the public and private sectors need to collaborate before, not just after attacks take place.

“While supply chains are invariably large and complex, it is vital that organisations gain better visibility and more effectively manage their third-party relationships and dependencies. Mapping these relationships and the data held by an organisation is key to increasing cyber resilience and making informed cyber investment decisions,” he adds.

This collaborative approach is an essential when mapping the supply chain in order to locate and minimise risks. Visibility remains a huge problem for supply chains, as 85% of supply chain disruptions originate from indirect Tier 2+ suppliers.