3CX Software Supply Chain Attack: Best Practices to Reduce Third-Party Risk

2. Build a map of third parties to determine technology concentration risk

Collecting 4th-party technologies deployed in your vendor ecosystem during the inventorying process helps to identify relationships between your organization and third parties based on certain technology usage and will help you visualize attack paths into your enterprise and take proactive mitigation steps. You can do accomplish this through a targeted assessment or via passive scanning.

In the case of the 3CX software supply chain attack, having a map of vendors that utilize the Electron solution for VoIP would help you zero in on which vendors to assess for potential malware exposure. Focus on top-tier or business critical vendors first, as a disruption in their operations has the potential to impact your organization more acutely.

3. Assess third parties’ business resilience and continuity plans

Proactively engage impacted vendors with simple, targeted assessments that align with known industry standards for supply chain security, such as NIST 800-161 and ISO 27036. Results from these assessments will help you target needed remediations to close potential security gaps.

Good solutions will provide workflow automation, review and analysis, supporting evidence management, and built-in recommendations to speed remediation and quickly close those gaps.

As part of the assessment process, require software vendors to produce a software bill of materials (SBOM). SBOMs can not only detail the components that make up a piece of software, but also explain the quality assurance (QA) and security assessment processes utilized during the software development process.

4. Continuously monitor impacted vendors and suppliers for cyber-attacks

Being continuously vigilant for the next attack means looking for signals of an impending security incident. Monitoring criminal forums, onion pages, dark web special access forums, threat feeds, paste sites for leaked credentials, security communities, code repositories, and vulnerability and hack/breach databases is essential.

You can monitor these sources individually, or you can look for solutions that unify all the insights into a single solution, so all risks are centralized and visible to the enterprise. Correlate all monitoring data to assessment results and centralize in a unified risk register for each vendor, streamlining risk review, reporting and response initiatives.

5. Test your third-party incident response plan

Automating incident response is key to reducing mean time to detect (MTTD) and mean time to respond (MTTR) to third-party incidents, which can reduce the impact of the incident on your operations.

As you continually improve your incident response plans:

• Leverage a centralized event and incident management questionnaire to reduce response times and simplify and standardize assessments
• Track questionnaire completion progress in real time to reduce the potential for impact
• Enable vendors to proactively report on incidents to add context and speed response times
• Use workflow rules to trigger automated playbooks to act on risks according to their potential impact to the business
• Issue remediation guidance to the vendor to get down to an acceptable level of risk to your organization

By centralizing third-party incident response into a single enterprise incident management process, your IT, security, legal, privacy and compliance teams can effectively work together to mitigate risks.

Next Steps for Better Software Supply Chain Security

Taking a manual, reactive approach to third-party software vulnerability detection and incident response will only increase your likelihood of a business disruption. Instead, implement the five best practices in this post to be better prepared for your next supply chain security challenge.

For more on how Prevalent can help reduce supply chain risk at every stage of the vendor lifecycle, read our white paper The Third-Party Incident Response Checklist, or request a demo for a strategy session today.