{"id":7101,"date":"2020-12-15T11:54:21","date_gmt":"2020-12-15T11:54:21","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7101"},"modified":"2021-03-10T08:39:18","modified_gmt":"2021-03-10T08:39:18","slug":"us-treasury-cyber-attack-suppliers-in-the-spotlight","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/us-treasury-cyber-attack-suppliers-in-the-spotlight\/","title":{"rendered":"US Treasury Cyber Attack Puts Suppliers in the Spotlight"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7101\" class=\"elementor elementor-7101\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The US Treasury cyber attack is yet another example that absolutely anyone can be the victim of a cyber attack, and another warning that cyber attackers are becoming ever more sophisticated. This time, it was a sophisticated supply chain attack that allowed the US Treasury, and at least one other US government department or agency to become the victim of a cyber attack.<\/span><\/p>\n<p style=\"font-weight: 400;\">\n<\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">It is suspected that just like the cyber attack on <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/fireeye-cyber-attack-an-attack-of-the-hgihest-level\/\"><span style=\"font-weight: 400;\">FireEye<\/span><\/a><span style=\"font-weight: 400;\"> last week, the <\/span><a href=\"https:\/\/www.reuters.com\/article\/us-usa-cyber-treasury-exclsuive\/suspected-russian-hackers-spied-on-u-s-treasury-emails-sources-idUSKBN28N0PG\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">US Treasury cyber attack<\/span><\/a><span style=\"font-weight: 400;\"> was the work of a nation state actor. Both victims said that they believed (although as yet not confirmed), that the Russian government was behind the attacks, an accusation that <\/span><a href=\"https:\/\/www.facebook.com\/RusEmbUSA\/posts\/1488755328001519\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">the Russian government denies<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The National Security Council met on Saturday to discuss this attack, due to concerns that this is just one part of a larger cyber espionage campaign targeting the US government, and that the US Treasury cyber attack is just the tip of the iceberg. It appears that the attack itself took place several months ago although it was only discovered now, and it will take time for the full scope to be understood, causing chaos and confusion for a while to come.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Was the US Treasury cyber attack a supply chain attack?<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The US Treasury cyber attack appears to have been a supply chain attack. Supply chain attacks target suppliers who are seen to be less secure, or have a specific vulnerability as a way of getting a back door into their ultimate targets.&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The attackers were able to exploit a vulnerability in a program called Orion from SolarWinds, a US government supplier. The attackers used this vulnerability to add malicious code to legitimate software updates, which were then uploaded to the government\u2019s networks. This in turn gave the attackers access within the agencies\u2019 networks, including employees\u2019 email accounts. In order to stay below the radar and avoid triggering the affected organisations\u2019 own cybersecurity teams, the infected update was programmed to remain dormant for two weeks after it was installed, and then to only upload small quantities of data, so that it looked like regular Orion traffic.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The affected updates took place between March and June 2020, enabling the attackers to monitor emails at the US Treasury, and the National Telecommunications and Information Administration (NITA) over the last few months.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">FireEye attack: Connection or coincidence?<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Some sources close to the investigation have suggested that both the FireEye attack that was announced last week, and the US Treasury cyber attack were connected as part of the same cyber espionage campaign. Access to both organisations was gained by leveraging a back door in a SolarWinds software update, suggesting that they are indeed connected.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">FireEye is a prominent cybersecurity company, with several governments (not just the US Government) as clients. The attack on FireEye can now be seen as an attack on a crucial supplier, which makes all their clients vulnerable to a supply chain attack.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The attacks on both FireEye and the US Treasury were extremely sophisticated, which is why they are concerned that they are down to nation state activity. If indeed the two attacks are just the opening salvos in a wider operation, it could take years before the full impact is understood.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Protecting against supply chain attacks<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Every organisation everywhere uses multiple suppliers in order to manage their IT. However each supplier poses some level of risk for their clients, which is then actualised when a malicious actor uses that supplier to attack their victim. Supply chain attacks are on the increase as malicious actors develop new, ever more sophisticated ways to attack their victims.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The risk from a supplier, partner, or vendor is known as third party risk. Many organisations blindly trust their suppliers, and don\u2019t carry out third party risk assessments to ensure that their suppliers have implemented the same level of cybersecurity controls that they do, which in turn increases their exposure to risk. However third party risk is a growing emphasis on suppliers in regulations such as GDPR, standards such as ISO 27001, and audit frameworks including SOC2, which is putting it firmly on the map.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Incidents such as this latest US Treasury cyber attack show the importance of managing third party risk including trusted software vendors. Some research has shown that evaluating the security and privacy policies of suppliers and other third parties, or <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/\"><span style=\"font-weight: 400;\">requiring suppliers to conform to information security standards<\/span><\/a><span style=\"font-weight: 400;\"> can significantly reduce the risk of a cybersecurity breach. The <\/span><a href=\"https:\/\/www.ncsc.gov.uk\/collection\/supply-chain-security\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">National Cyber Security Centre<\/span><\/a><span style=\"font-weight: 400;\"> have even published a set of guidance on how to secure the supply chain, and promote ways to ensure that a supplier doesn\u2019t inadvertently let an attacker in.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In addition, each organisation should have a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">robust software update process<\/span><\/a><span style=\"font-weight: 400;\"> that enables DevOps teams to test and verify software updates from third parties and monitor for emergency patches following on from an update.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The final lesson of this incident is that every organisation\u2019s cybersecurity posture is only as secure as their weakest supplier, as the US Treasury just discovered.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Stay safe.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>The US Treasury cyber attack is yet another example that absolutely anyone can be the victim of a cyber attack, and another warning that cyber attackers are becoming ever more sophisticated. This time, it was a sophisticated supply chain attack that allowed the US Treasury, and at least one other US government department or agency&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7106,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7101"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7101"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7101\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7106"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}