As with any security scenario, physical or cyber, there is no ‘silver bullet’ for securing a supply chain so it should be managed with a ‘defence in depth’ or ‘layered defence’ approach. Securing a supply chain is a multi-faceted problem, so applying controls to all aspects will place you in such a posture naturally.

Continual review of compliance with data protection laws and classification, corporate governance, strategy, policies, and procedures are key to ensuring a proactive stance when planning how to protect and secure a supply chain. This applies far beyond the boundaries of responsibility for a company, business, or organisation to include third-party suppliers and vendors too.

Engaging with suppliers and vendors as far as the necessary tier to identify critical assets, vulnerabilities and allow expansion of risk management across all parties will be a step closer to achieving end-to-end security. Partners up and down the supply chain can assure compliance with one another through audits, certification, and standards.

When considering a breach of security or an incident to a supply chain, reaction times to plan a response and recover could increase the impact such as loss of revenue for example. Incident response and recovery plans should not only exist for an organisation but they should be practised vigorously. Exercises should be coordinated with partners to identify lessons, understand the implications, and establish controls for incidents that occur for real.

Nexor’s advisory services are focused on investigating where potential risks to supply chains might exist. The value of the Nexor service is based upon the combination of our own experiences of implementing and managing a secure process for our own supply chain and the threat data from our partners, enabling us to provide an end-to-end service from risk identification to mitigation.

Nexor’s consultants have broad security experience with the depth of knowledge of processes necessary to comprise a tailored approach for satisfying specific customer requirements. This might include, but not be limited to:

• Auditing using NCSC approved frameworks against legal, contractual, standards and policy compliance.

• Cyber Vulnerability Investigations with a socio-technical approach that will identify evidence-based risks you will be exposed to and recommendations to holistically manage them.

• Threat Hunting and analysis using intelligence gathering portals to carry out comprehensive searches from Open Source Intelligence (OSINT) and the Dark Web.

• Research: Nexor have recently focused on the challenges of a high-assurance software development supply chain and how software can be developed securely in an unclassified supplier environment for deployment into a customer’s secure facility.