Businesses are overestimating their ability to respond to supply chain cyber attacks and their visibility over suppliers, according to new research from global cyber security firm NCC Group.
The State of Supply Chain Security report reveals that the vast majority (94 percent) are confident in their ability to respond to a supply chain attack, despite that nearly half (45 percent) experienced a cyber security breach in the last year. Half (49 percent) of the organizations that suffered a breach said the attack suspended operations. The report also revealed that 92 percent of organizations trust that their suppliers follow cybersecurity best practices.
However, high trust levels could be leaving businesses and their supply chains vulnerable to threats, with the research showing 34 percent are not regularly monitoring suppliers or conducting risk assessments, and an identical 34 percent claim to have full and detailed insight into their supply chain’s cybersecurity.
Despite businesses understanding that security threats are growing, with 68 percent expecting attacks to become more severe in the next 12 months, the data suggests a lack of awareness about the impact that a supplier attack could have on day-to-day business operations. Surprisingly, 21 percent of organizations surveyed believe they wouldn’t be affected if a key supplier was unable to operate for five days.
Mike Maddison, CEO of NCC Group said: “Global supply chains are the engine of modern business, so it is critical that their security is a priority for leaders, especially when global ransomware levels are at a record high this year. The outbreak of high profile supply chain attacks we have seen this year must be taken as a wake up call.
"These attacks have real world consequences, delaying medical procedures, grounding flights, leaving shelves empty and putting the economy and jobs at risk. In the face of such a threat, it is shocking that 92 percent of respondents trust their suppliers to follow cyber security best practices.”
Among other findings:
- 45 percent of suppliers say the cost of cybersecurity measures is the greatest pain point in regards to cybersecurity and compliance.
- Only 36 percent say they have visibility over how their supply chain stores and protects business-critical data relating to their organization.
- 59 percent are concerned about the level of visibility they have over their supply chain.
The findings come as more stringent cyber security regulation has been introduced globally to boost resilience strategies. This includes the UK’s Cyber Security Resilience Bill, as well as the EU’s NIS2 Directive and the Digital Operational Resilience Act (DORA).
Increased regulation is welcomed by businesses, with 90 percent confident that cyber security standards and policies reduce the risk of supply chain attacks. Yet, the introduction of more legal frameworks could make managing supply chains more complex for global businesses.
