Log4Shell, a zero-day vulnerability exposed in December of 2021, underscored the cyber risks inherent in the supply chain and emphasized the need for organizations to develop and maintain resilient third-party risk management programs. The exploit highlighted the critical need for security leaders to have complete visibility into their enterprise, including an understanding of the risks introduced by their organizations’ third-party vendors. 

At the recent SC Media eSummit on Third Party Risk and the Supply Chain, A&M Managing Director and cybersecurity expert Rocco Grillo, and Kostas Georgakopoulos, Global CTO & CISO, Mondelēz International, shared their views and advice on the steps enterprises can take to manage third-party risk and to enhance an organization’s overall cyber resiliency in light of similar zero-day vulnerabilities. 

Organizations should consider taking the following actions to enhance their overall cybersecurity posture and resiliency in relation to third-party risk:

1. Regularly assess your vulnerability management program. Vulnerability management programs should be regularly reviewed and updated to address new and emerging risks, and potential exposures. Upgrading assets and affected products to the latest version of patches as soon as patches are available and regularly monitoring for vendor software updates is critical.
2. Review and update your incident response plan. A resilient incident response plan should include considerations for impact from potential vulnerabilities introduced by third-party vendors. Incident response plans should be reviewed and updated as well as to include initiating threat hunting and incident response procedures in order to detect possible Log4Shell exploitation as well as other zero-day vulnerabilities. 
3. Conduct tabletop exercises focused on supply chain risk. Tabletop exercises help to increase education and awareness of risks for executive management and the board. The exercises also assist cyber leaders with planning and preparation for cyber events and aid in identifying gaps in the response processes.
4. Develop strong relationships with your supply chain vendors. In addition to managing commercial contracts with suppliers, including disclosure around vulnerabilities and defining liability, organizations should look to build a culture of partnership and transparency with their vendors.
5. Proactively retain a forensics or incident response firm. In the event of an incident, having an incident response or forensics firm on retainer will allow for a more effective and timely response.

Watch the full recorded session with SC Media here.