Whether implementing a zero-trust security model to monitoring communication software, security experts have identified 6 key strategies organizations can use to mitigate third-party attacks.
Organizations face risks from attacks on their software supply chains and other trusted third parties. Attackers impact numerous organizations as they aim to steal data and establish a presence on their networks.
Attackers attempt to exploit vulnerabilities in these widely-used third-party products, leading to an expectation that attack frequency will increase. Experts agree that detecting attacks that use these trusted third-party and supply chain partners will prove challenging. However, the importance of doing so becomes increasingly critical every day.
Security experts have identified six key strategies that enterprises can use to limit their exposure to mitigate third-party attacks.
Strategy 1: Use a Zero-Trust Model
Most attackers first gain an initial foothold on the target network, then expand access laterally. By implementing a zero-trust security approach, companies can help contain this lateral movement in order to mitigate third-party attacks.
A zero-trust model requires companies to authenticate and vet all access requests, whether they come from inside or outside the enterprise network. This will ensure that users don’t have access to applications or privileges they don’t need and minimize damage in case of a breach.
Strategy 2: Identify the Baseline of Normal Activity
Organizations should take the time to identify the software that is essential to the business and its functions. Then, they should establish a baseline for everyday use and communications patterns.
When enterprises are familiar with this baseline activity, it becomes much easier to spot malicious patterns. Organizations should also use system integrity monitoring. Utilizing time sync to spot events occurring at the same time or within the same period will enable abnormalities to be more easily seen. Abnormalities could indicate an infected software update or patch, acting as an entry point for malware or other unwanted activity.
Strategy 2: Identify the Baseline of Normal Activity
Organizations should take the time to identify the software that is essential to the business and its functions. Then, they should establish a baseline for everyday use and communications patterns.
When enterprises are familiar with this baseline activity, it becomes much easier to spot malicious patterns. Organizations should also use system integrity monitoring. Utilizing time sync to spot events occurring at the same time or within the same period will enable abnormalities to be more easily seen. Abnormalities could indicate an infected software update or patch, acting as an entry point for malware or other unwanted activity.
Strategy 3: Focus on Visibility, Detection, and Response Capabilities
Having the proper controls in place is essential in spotting malicious activities and mitigating third-party attacks. The key to fending off attackers? Invest in visibility, detection, and response capabilities.
In most attacks, once bad actors get past initial entry vectors, there is a period after the initial infection before things get terrible. Companies should be focusing on network detection and response tools and EDR (endpoint detection and response) to identify abnormal behavior at this point.
Enterprises should incorporate controls to identify known risks and behavior that could indicate malicious activity. By doing so, companies can better cover their bases and mitigate third-party attacks.
Strategy 4: Protect Web Apps
Third-party code makes up for more than 70% of the code that executes on a user’s browser. This includes Google, Facebook, ad companies, and more.
This code comes from third-party servers, and a compromise to any of it could give bad actors the ability to capture information from the browser. To address this, enterprises should put controls in place to identify and inventory all third-parties and supply chain partners.
Understanding what kind of data is accessible is step-one in protecting web apps. The next step is making sure that any changes or updates to these codes can be detected and blocked if necessary. Ideally, this needs to be done in real-time to guarantee the most protection.
Strategy 4: Protect Web Apps
Third-party code makes up for more than 70% of the code that executes on a user’s browser. This includes Google, Facebook, ad companies, and more.
This code comes from third-party servers, and a compromise to any of it could give bad actors the ability to capture information from the browser. To address this, enterprises should put controls in place to identify and inventory all third-parties and supply chain partners.
Understanding what kind of data is accessible is step-one in protecting web apps. The next step is making sure that any changes or updates to these codes can be detected and blocked if necessary. Ideally, this needs to be done in real-time to guarantee the most protection.
Strategy 5: Use Code Integrity Checks
Organizations should also verify the integrity of their code. Monitoring code repositories, having a chain of custody in place, and identifying when third-party code has been changed are all vital to fending off attacks.
Enterprises should also make sure they know who has the authority to make changes to their code. Code integrity checks aren’t easy, but they are doable. Organizations should refer to the essential controls recommended by the Center for Internet Security.
Strategy 6: Monitor Communication Software
Because attackers can sneak malware into support portals or forums, organizations should monitor customer communication software for unusual activity. While tracking communications to detect malicious behavior can be challenging, it’s in the organization’s best interest to do so. This is especially true after an upgrade or patch.
By closely monitoring any changes in communications, organizations can compare that activity to baseline activity. From there, it will be easier to identify abnormal activity and mitigate third-party attacks.
Strategy 6: Monitor Communication Software
Because attackers can sneak malware into support portals or forums, organizations should monitor customer communication software for unusual activity. While tracking communications to detect malicious behavior can be challenging, it’s in the organization’s best interest to do so. This is especially true after an upgrade or patch.
By closely monitoring any changes in communications, organizations can compare that activity to baseline activity. From there, it will be easier to identify abnormal activity and mitigate third-party attacks.
Leave A Comment