Supply Chain Resilience: Complex, Interdependent and Systemic
The challenge
It is tempting to focus on the management of risks within the boundary of a single organisation where we can establish governance and culture, create systems and controls, audit and monitor compliance. Our world is now far more complex that that, with dependencies on an ecosystem of partners and suppliers, giving rise to challenges of systemic risk associated with the critical nodes within that ecosystem.
Our approach to managing resilience demands we engage with many third parties who may not share our culture or incentives, and certainly not our systems and processes. The world of cloud, software as a service (SaaS) and open application programming interfaces (API) – challenges us to rethink our approach to risk and resilience.
The changing pattern of cyber attacks we have seen over the last 5 years shows that organised crime (and indeed States) are alive to this issue, and willing to exploit our dependencies for financial and political gain.
In 2017, the destructive wiper malware known as NotPetya struck several unsuspecting firms despite their maintaining costly in-house security operations and controls. The initial vector for the attack? The compromise of a tax and accounting software package little used outside the Ukraine produced by a small-to-medium sized enterprise.
In the case of shipping giant Maersk, all it took was one infected Odessa-based system connected to the corporate network to compromise much of their global network. In total, the NotPetya compromise cost Maersk somewhere in the region of $250-300 million.
Likewise, in 2020 it was revealed that Russian hackers had successfully introduced a backdoor into the Orion software system of SolarWinds, a major IT firm with some 33,000 Orion users as customers. Included amongst these were Microsoft, Cisco, Intel, Deloitte, and various US Federal agencies. Alongside reputational damage, the affected organisations were left with the uncertainty surrounding whether sensitive company data had been exfiltrated and whether their systems were secure or not.
Of course, technology failures also play their part, with configuration changes to complex technology causing surprising levels of disruption. Facebook’s outage on the 4th October 2021 was attributed to a routine maintenance job which resulted in a command being issued to assess capacity on their global backbone. That, well-intentioned, command took down the whole Facebook global backbone and disconnected all of their data centres.
Fault finding and diagnostics when the network is down is hard, and so was physical access to some of the data centres sites. Restoration of complex and interdependent services takes time, and so it did for Facebook, and for many firms who depended on their services.
While isolated cases, these do illustrate a broader trend toward malicious supply chain attacks which sits alongside other cases in which systemically important infrastructure is disrupted or fails for a wide range of reasons from technology failure to human error.
Want to speak to us?
If you would like to discuss a cyber or resilience problem with a member of the team, then please get in touch however you feel most comfortable. We would love to help you and your business prepare to bounce back stronger.
