Government consults on steps to bolster supply chain security | #government | #hacking | #cyberattack

The UK government has proposed a number of measures to enhance the security of digital supply chains and third-party IT services in light of a series of devastating cyber attacks.

The Department for Digital, Culture, Media and Sport (DCMS) has opened a consultation on how organisations manage their supply chain risks, with a view to reforming existing guidance and refine a proposed new security framework.

This framework for managed service provider (MSP) security would require MSPs to legally meet the 14 cyber security principles that make up the existing Cyber Assessment Framework. These currently apply only to organisations within the UK critical national infrastructure (CNI) sector, those subjected to the NIS Directive, and businesses managing cyber-related risks to public safety.

Under the proposals, organisations may also be asked to instigate policies to protect devices and prevent unauthorised access, ensure data is protected at rest and transit, keep backups secure and accessible, and train staff in cyber security.

“There is a long history of outsourcing of critical services,” said digital infrastructure minister, Matt Warman. We have seen attacks such as ‘CloudHopper’ where organisations were compromised through their managed service provider. 

“It’s essential that organisations take steps to secure their mission-critical supply chains – and remember they cannot outsource risk.

Related Resource

X-Force threat intelligence index

Understand the threat landscape with fresh intelligence

Download now

“Firms should follow free government advice on offer. They must take steps to protect themselves against vulnerabilities and we need to ensure third-party kit and services are as secure as possible.”

The consultation on strengthening supply chain cyber security follows several high-profile attacks against thousands of businesses, described as supply-chain hacks.

One of the scariest of modern history, the SolarWinds Orion Platform hack, was detected in late 2020 and affected countless businesses and public sector organisations. Similarly, the Microsoft Exchange Server attack, more recently, hit at least 30,000 businesses within the US, and many more across the world. 

These are just two of several attacks, including one against CodeCov in which hackers accessed the source code of cyber security firm Rapid7.

The government’s consultation on supply chain cyber security aims to seek views from firms that both procure and provide digital services, asking them whether the UK needs updated guidance or strengthened rules. This call for views is now open and will close on 11 July. 

Featured Resources

MLOps 101: The foundation for your AI strategy

What is MLOps and why do you need an MLOps infrastructure?

Download now

Leveraging knowledge management to scale business

Get the right knowledge to the right person at the right time

Download now

The Forrester wave™ enterprise detection and response, Q1 2020

The 12 providers that matter most and how they stack up

Download now

The total economic impact of Nutanix for end user computing

Cost savings and business benefits enabled by Nutanix HCI for end user computing

Download now

Original Source link

Leave a Reply

Your email address will not be published.

99 − eighty nine =