This WithSecure™ special report explains how organisations must rethink supply chain cyber security to avoid the ‘butterfly effect’: small mistakes or oversights having much larger and more serious consequences later on. For the C-Suite, the lessons are numerous and sometimes unexpected, as business and IT leaders from different industries explain.

For this report, WithSecure™ spoke to security leaders across a range of digital, physical, and hybrid businesses, together with security experts and consultants. Some are quoted and others not, but all their viewpoints inform this document’s contents. External interviewees appear under Chatham House rules.

A chain is a series of linked, often identical things in a single line or loop. And while it may be comforting to think of supply chains in the old-fashioned sense – raw materials in, finished products out, containers on ships and boxes on trucks – today’s supply chains are almost never so linear, uniform, or analogue.

In a networked, information-based, omnichannel digital economy, even traditional supply chains rarely have a simple beginning, middle, and end, now that so many supporting processes and relationships have been digitised.

Supply chains are no longer a single line of dominoes on a table, perhaps, but more akin to a warehouse full of thousands arranged in interconnected patterns. Knock one piece over and we all know what happens next.

But that metaphor no longer works so well for the modern supply chain, because dominoes are all the same size and shape. Any organisation today might work simultaneously with the largest multinational or global technology platform and the smallest local start-up or app developer. In between will be businesses of every size and shape, supplying every type of good, material, or service – both upstream and downstream.

This is one reason why cyber attackers – organised criminals, hostile states, black-hat collectives, activist groups, or opportunistic hackers – are increasingly targeting our sprawling supply networks and ecosystems. Those supply chains can extend and amplify a successful attack’s impact and influence, spreading risk throughout entire industries.

For criminals, that’s good for business.

IT and DevOps teams often use open-source and other code repositories, reusing trusted components that have been coded by a global network of peers. Those repositories are themselves now under attack, as are popular cloud platforms, managed services, and utility applications.

According to WithSecure™ research, attacks on specific applications peaked in 2017, while hits on utility software hit apex in the following year. However, attacks on popular code repositories have been soaring since 2020 and are increasing every year. We should regard all these incidents as explicit assaults on trusted relationships and collaboration.

So, when it comes to the software elements of your digital supply chain, WithSecure™ urges you to always select suppliers who are vigilant in cyber security – especially when providers may be small companies or sole traders.

The first thing to understand is that the IT perimeter of any member of a supply network now extends far beyond your head office – via cloud platforms, shared services, mobility, remote working, and more. This process accelerated during the pandemic and has made endpoint detection and defender systems essential to have.

This is why some security professionals now claim that the perimeter is dead. It isn’t, but it has become much harder to map and quantify. Yet quantify it you must, to stand any chance of getting to grips with both external and internal cyber threats. How can you secure what you don’t know you have – or spot attacks as they happen?

IBM X-Force Threat Intelligence Index 2021 revealed that scanning for vulnerabilities has overtaken phishing as the most common attack vector for cybercriminals – a process that may be automated. This both explains the soaring attack volumes on open-source and other code repositories, and increases the pressure on organizations to understand the assets at their perimeter.

The good news is that External Attack Surface Management (EASM) is fast emerging as a discipline for mapping and managing the perimeter before any weaknesses can be exploited. WithSecure™ has published dedicated advice on this subject, and we suggest you look at deploying EASM systems.

Meanwhile, every employee will have their own networks of connections. At any of those touchpoints that employee could be compromised, whether by malicious code in an email or by someone reading their mobile over their shoulder. The knockon effects of that could impact the whole organization – and far beyond. The classic butterfly effect.

Cybersecurity training and robust policies are important, but the potential for human error remains. Therefore you need an additional layer of security for endpoints, especially when employees are working remotely.

So, the key lesson is that supply-chain security is no longer a simple end-to-end process, but rather a complex mix of accumulated risks, interconnections, and interdependencies – including personal responsibility.

Let’s explore what some of those are.

In the old linear supply chain model, our suppliers were upstream from us and our customers downstream.

Those customers now interact with us in a multichannel world and trust us to keep their data safe, yet they could easily become collateral damage in an upstream attack. But equally, an attack on a customer – a company that buys our products or services, for example – could have complex repercussions for us higher up the chain.

So, in terms of cyber security today, we are all effectively downstream from each other in our modern supply networks, because a security breach might come from any part of that ecosystem and spread in any direction, with repercussions that become more serious as the risk is passed on.

Again, that’s the butterfly effect.

In this sense, digital transformation programs may have hidden impacts on supply chain security, given that their core purpose is often consolidation and simplification in the cloud.

The alternative is to go with a mix of best-of-breed systems. The security bonus here is that these are harder to target at scale, but they may also create an estate that is much tougher to quantify.

In general, however, such decisions are not ours to make in the supply chain, unless we are a multinational superpower or global tech platform, which may have the reach and clout to enforce their own standards and tell others how to operate. But with such great power may come too much ability to limit partners’ opportunities to innovate.

“ When you globalize things but the primary key for doing so is enforcing a set of standards, or reducing your costs, on the security side you are actually making things more vulnerable. It's much harder for an attacker to take out an organization if that organization is in 1,000 different bits. But when you bring it into one platform, they’ve only got one target to hit.

“ So, in a transformation, you need to have areas of the business that are ringfenced off. But with digital transformations, it’s often all about the transformation itself, or the money. Security is not in the same aisle. Your transformation people tend to come in, do a transformation, then leave the security problem for someone else.”

Jordan LaRose, Director of Consulting & Incident Response, WithSecure™

Although he didn’t coin the term – that came later – American author Ray Bradbury’s 1952 short story, A Sound of Thunder, introduced the concept of the butterfly effect.

In his cautionary tale, one of a group of time travelers to the prehistoric past strays off the safe path that his team must follow through a dangerous forest full of dinosaurs, and accidentally treads on a butterfly. Back in the present day, the team finds the world has been catastrophically changed, in countless different ways.

The first lesson is clear: one tiny mistake, even something apparently innocent, can ripple outwards with disastrous consequences. In the story, a single action echoes throughout history, with each knock-on effect being larger than the one before it – a feedback loop.

This idea of interdependencies in closed systems was proposed in 1800 when philosopher Johann Gotlieb Fichte noted that moving a single grain of sand would “change something throughout all parts of the immeasurable whole”. Today we think in terms of technology ecosystems, a concept that underlines Fichte’s point: small actions within them have holistic effects.

In the 1960s, meteorologist Edward Norton Lorenz popularized the concept by suggesting that a single flap of a seagull’s wings could, over time, whip up a storm. Then in 1972, he changed the metaphor to a single beat of a butterfly’s wings eventually creating a hurricane.

That powerful image stuck in people’s minds, like an early meme. But Bradbury’s original take is more instructive for organizations today, because in his story, the team learns other valuable lessons too.

So, what are those lessons?

We all know about organized criminals, hacker collectives, and hostile states – genuine threats, of course, and the equivalent of Bradbury’s tyrannosaurs. And we have all heard of phishing, ransomware, trojans, viruses, malware, and data theft, all of which are lurking out there in the undergrowth of the internet’s vast technology forest.

The challenge is that, in an increasingly cloud-based or hybrid IT environment, many hackers – including lone, have-a-go attackers – are now trying to make their attacks look like normal network traffic. Or as we have seen, they are attacking trusted tools and code libraries.

Today’s opportunistic cyber criminals increasingly look for ways to exploit normal functionality or poorly configured systems: to be the butterfly on the sole of your shoe at head office.

All of which makes threat detection a must-have for supply chain security, particularly in hybrid cloud estates. Such applications are moving away from the exclusively endpointbased telemetry data of old, and towards what we might call the ‘telemetry of actions’.

These are actions in the control plane of your cloud platforms – in the web of APIs that allows an administrator to create, modify, or destroy computing or data resources in a cloud environment.

Increasingly, sophisticated attackers use APIs like these to reach their goals. For example, they might create new user accounts, modify permissions on existing accounts, or grant access to resources from external locations. These activities create traffic that might appear legitimate to the unwary or inexpert eye.

In other words, today’s attackers might not roar and strike at your door – though they could do that too in a distributed denial of service (DDOS) attack or by hacking your corporate portal. Instead, they aim to flutter in through the window you’ve left half open.

Hundreds of millions of lines of malicious code are floating through the dense forest of our hybrid, interconnected infrastructures. Hostile forces want these to seem innocent and risk free. They want you to find them attractive, to allow them into the enterprise.

Fiction is all well and good, but are these attacks really happening, and in the way this report suggests? Emphatically, yes. There have been at least 200 dedicated supply-chain attack campaigns over the past decade – attacks that have each affected countless supplier networks and millions of customers. Plus, there have been numerous attacks on IT systems and applications that have impacted on supplier, buyer, and customer relationships, or damaged trust in institutions and brands.

Some of these attacks have been widely reported.

In 2020, hackers compromised the Orion system made by US tech provider SolarWinds, adding malicious code to software that was trusted by 33,000 corporate and publicsector customers.

Unknown to SolarWinds, this infected code was sent out in standard software updates to at least 18,000 of those customers, making the vendor part of the attack vector in a rolling program that went undetected until 2021.

Throughout this period, attackers were able to use their exploits to access the internal systems of SolarWinds’ customers – and the private data they held – to spy on them and install more malware.

Victims included the US federal government, one of the biggest and most secure supply chains in the world. In that process, some of America’s security touchstones were hit, including the Pentagon, the Department of Homeland Security, and the National Nuclear Security Administration, not to mention several universities.

However, private-sector victims included IT behemoths Microsoft, Intel, and Cisco, compromising yet more trusted systems and supply chains, and striking at the heart of both the internet’s core infrastructure and the enterprise cloud.

Exactly as in the story, a lone butterfly on a shoe changed the world.

The 2021 ransomware attack on software made by tech management provider Kaseya hit at least 1,500 different organizations. Russia-affiliated hacker collective REvil exploited two vulnerabilities to break into more than 50 managed services providers (MSPs), each of which sat at the center of complex supply-chain networks.

This was another attack that fanned out across others’ digital supply chains, using customer trust to breach critical systems and, in the process, undermining that trust.

Other attacks have been harder to quantify, and therefore to combat, which is why vulnerability management is important in giving you a risk-based view of your whole attack surface.

The late 2021 attack on free, open source, Apache logging utility Log4j allowed attackers to remotely execute code (an RCE attack).

Log4j is one of the most popular tools for recording and collecting data on users and online behavior, having been downloaded millions of times. In retrospect, therefore, it seems like an obvious target.

This is why thinking like an attacker is so important – even if specific threats are unknown. Ask yourself, what might an attacker use to compromise your systems? Carry out a red-team threat-detection exercise, modelling possible attack patterns. Or use a purple-team model, combining offensive and defensive (blue) tactics.

The Log4j attack has so far been linked to ransomware, cryptojacking, and numerous other incidents. But its longerterm repercussions remain unknown. It may have been the biggest supply chain attack to date; certainly, it was rated 10/10 for risk on MITRE.

However, the attack with the biggest financial impact to date was the 2017 NotPetya malware assault on Ukrainian tax-filing application, ME Doc.

Use of this software was mandatory for every tax-filing business in Ukraine: at that time, a total of over 400,000 enterprises. Spreading via updates and other methods, the attack cost organizations an estimated $10 billion, mostly in collateral damage.

As more and more nations digitize fiscal dealings between citizens, businesses and government – the UK recently ordered some tax returns to be filed via dedicated software at the user’s end – these types of attack will inevitably become widespread.

More, they exist in a world in which the public sector seems keen to make it the private sector’s problem, pushing the security onus away from government and onto SMEs and sole traders. In the UK, 99 percent of companies are SMEs. Therefore, a successful attack on SMEs’ tax affairs would be catastrophic: in other words, highly profitable for criminals.

Other successful anti-supply-chain campaigns have included attacks against utility software, such as code-testing application Codecov. In that incident, scripts gathered user credentials and sent them to the attackers, giving them privileged access to Git repositories (virtual code hubs) for more than two months before the incursion was discovered.

This underlines the point that many of today’s supply chain attacks don’t roar and beat their chests like Bradbury’s monsters, but steal credentials to mimic normal network traffic. In this way, they can pass unnoticed for long periods – yet another butterfly on the enterprise’s shoe.

Cyber criminals generally target libraries that are used in larger products. Again, this emphasizes the need for red- and purpleteam security exercises that model how attackers might sneak into your supply networks unobserved.

Though comparatively rare, there have been examples of attackers compromising the physical IT supply chain, too, implanting backdoors into hardware components.

For example, WithSecure™ knows of an upstream microchip company which discovered that a backdoor had been printed into the firmware of every graphics chip it had been releasing, until the backdoor was finally discovered and wiped from the library.

The chipmaker found that attackers had compromised a Web-based integrated development environment (IDE), through which they had been able to access a developer account, write the backdoor, and upload it to the central code repository.

The hidden cost of supply chain attacks

But while many of these anti-supply chain campaigns have had known, quantifiable effects, most have hit every organization to a lesser degree.

That’s because of a little-considered consequence of major supply-chain incidents and breaches: every security team has to investigate whether their organization has been affected by the attack. Even if, in most cases, it transpires that they have not.

As such, supply-chain attacks are truly insidious: they have a global impact in terms of time, money, skills, and human resources, and this diverts organizations from focusing on their strategic business objectives.

That’s one of the challenges reported by our first case study interviewee.