In supply chain management, the best defense is a good offense

Attacks on supply chains are a growing threat to global organizations -- and every organization's supply chain is global at some level. As organizations grow, their supply chains become more complex and intertwined. And as their supply chains become more complex with every added tier, they become more vulnerable to attacks. In fact, KPMG estimates that up to 80% of all security breaches originate in the supply chain.

Identifying, tracking and addressing vulnerabilities in a global supply chain -- like that of a federal agency -- requires the ability to think quickly and act decisively, but too often decision-makers are caught with a deficit of information from which to make informed business decisions. They know there's trouble but, unable to process its dimensions and locate its source, they hesitate until it's too late.

Once an attack activates, the impacts ripple throughout the supply chain -- upstream and downstream --leading to potentially massive losses in real dollars and time. No matter how "smart" a cybersecurity system and program is, there will always be a vulnerability if it's designed to play defense. According to PwC, 40 percent of all cyber-breaches originate with past partners and Symantec has estimated that 20 percent of all attacks target the manufacturing and service sectors, with victims embedded deep in the supply chain. But these attacks don't take place in a vacuum. The numbers do not tell us what external factors could make an attack more likely and where the "hot spots" are at any given time. 

After all, a global supply chain may have hundreds of dynamic partnerships and may include dozens of manufacturers or service providers, each with their own multi-tiered supply chains. Without the ability to visualize your entire global supply chain, including third-party suppliers, it's virtually impossible not to get caught off guard regardless of how sophisticated your security program is.

Let's take a fictitious government light rail project as an example. For the system to work, there is an interconnected network of thousands of vendors, from electronics OEMs and their suppliers; fuel sources and the associated procurement networks; heavy machine manufacturers and suppliers of steel, glass and HVAC units; construction firms who must order new equipment; contractors who furnish the inside of cars. Perhaps you have millions of dollars riding on the delivery of 50 new cars by the end of the quarter. One day, you learn that there was a mass workers' strike in the Asian city where the seats are manufactured, forcing a closing of the factory where your seats were being made. Not only did you not know there were labor issues to begin with, but you then learn that the accounts payable systems were not properly patched when the workers walked out. There was a cyberattack. All activity downstream from the seat factory is shut down until the situation is sorted out. Even if it's just a matter of days, you'll still be looking at a huge financial setback.

The key to preventing or mitigating such scenarios is to understand the context in which attacks often take place and position resources ahead of time so you can ensure resiliency. With the use of artificial intelligence it is more possible today than ever to map every node in your supply chain and identify new external conditions -- weather, geopolitical conflict, labor and economic trends -- that could result in increased vulnerability to attacks. The ability to model the impact of various plausible scenarios allows you to determine when, where and how to deploy preventive measures, which is an economic game changer. Quite simply, a supply chain risk management program cannot meet the demands of today's global operational environment without an increased level of visualization and dynamic insights publicly.

There are tens of thousands of real-time data sources that a good platform can aggregate in order to produce a picture of the external environment surrounding each point in an organization's web of relationships and digital connectivity. A good visualization platform can map this entire global network, dozens of tiers downstream and back upstream. It can then aggregate global data from tens of thousands of databases -- including those that are publicly available, commercially available, transactional, or social media-based -- in order to assemble a picture of the local forces that could translate to an elevated risk of attack for your environment.

Most importantly, we've learned that doing this with people to create reports and 25-page supplier assessments don't work anymore -- the world and businesses in it are constantly changing. Real time alerts, on top of this information, positions you for proactive versus reactive operations. If you read about it in the paper, it's too late. We all know that great offense is the best defense, especially in protecting your supply chain. The good news is you can play offense -- and you can play it decisively with tremendous precision.