Supply Chain Compromise Part 2

00:00

hello and welcome to Part two of our supply chain compromise discussion. Let's go ahead and pick up where we left off

00:10

through on that. So let's talk about some mitigation techniques here for, um, for us, for businesses, for vendors, whatever the case may be.

00:19

Now for us, as practitioners, we want to look for unused dependencies. So if something isn't serving a purpose, or if it's not providing a benefit or if it just seems to be out of place in software, whatever the case may be, we'd want to remove that or not use it.

00:37

And then we want to look at previously vulnerable dependencies. That's important. So if there was a sea VE or some type of release by the vendor that indicated there was vulnerable components of the software

00:50

and it is for version 1.3 and below and we're running version 1.1,

00:57

then we need to look to maybe do some updates and get it current

01:00

removing unnecessary components, so versus dependencies. If there are components of the software, like if there are AP eyes that we're not going to use if there are functions and features that we're not going to take advantage of it. There are compartments that we don't need to use in a particular suite of software.

01:22

Then we can reduce the attack Victor's or the capabilities of a threat actor. Potentially,

01:26

by not running every single piece of software, you know, if we can go through and do advanced installations and install only the components that we're going to need to function and to be productive,

01:40

then that would be the best way Teoh cut down on capabilities here.

01:44

Now,

01:46

if you have the capability, manual or automatic code review is something that you could do is well. There are some tools out there for reading, like things like Python and other types of code in an automated fashion where it just looks at the code out right, and it tells you where there may be some areas of risk.

02:04

But if you have the capability to do manual code review

02:07

and look for things like redirects or links, that would pull maybe malicious files on the backhand or something of that nature,

02:16

that would definitely be something that you would want to try to do and then checked for anomalous network activity. And so we reviewed the CC cleaner case at a high level. And have we not had the Threat analytics in place to find

02:30

this activity, to correlate it to maybe go back and do some checks and see if the threat actor was there for a long period of time?

02:38

If those things weren't in place, then they would have never seen the activity, and we would have had a repeat of the CC cleaner compromise. So

02:46

it's good to have controls in place that go outside of just the software itself. But overall, looking at network activity account activity, things of that nature you're going to see as being, um,

02:59

kind of a repeat in this and really that that should more so be in the detection techniques. But these detection techniques are more directly involved in checking for supply chain issues, not so much just

03:14

detecting anomalous activity.

03:15

So when talking about supply chains, verification methods such as integrity or has checking mechanisms are great

03:23

if the vendor publishes check sums

03:28

and if those air four

03:30

vendor approved and confirmed updates if

03:32

ah threat actor does intercept it

03:36

after the fact that they sonnet as a trusted entity

03:38

and it does in fact, alter the check some or the integrity of that file,

03:44

then you're good to go. But if the, um vendor publishes

03:49

the APP and it was manipulated prior to them doing a hasher an integrity check in publishing that,

03:55

then that would make it much more difficult to detect.

04:00

Now the other side of this is when we talk about network activity and malicious activity, you could always install the software or the application that you plan on using in a sandbox environment.

04:14

And then, you know, give it, like maybe an Internet connection so it can call out to maybe command and control center. If it's got something like that going on to the Threat actor

04:23

and just monitor that applications activity for a period of time just to see if something comes up to see if it does anything suspicious or sneaky before fully implementing the software across the environment because you could have other issues in the environment that would be

04:40

from a threat. Actors activities that may not be tied to the software. So if you've got a controlled system in place,

04:46

that you can do this type of testing on that would be beneficial, especially if you're in a high security environment

04:51

now, much harder of the three recommendations. But supply chain attacks can happen with manipulation of hardware, how and things of that nature. So if you're working in a secure facility or something of that nature, you're probably already inspecting hardware. But if you're a midsize business or enterprise

05:12

and you get a bulk older of keyboards or microphones or cameras or something of that, nature may be beneficial to again. Plug hardware in, look for suspicious activity, maybe open a piece up

05:27

and look for keystroke loggers or pieces that just don't belong.

05:31

Um,

05:33

that's going to be tedious, and it's probably going above and beyond. But if that is what truly concerns unit is a risk for your organization,

05:43

then it would definitely be ah detection technique that you would want to implement or use.

05:48

So now let's do a quick check on learning true or false supply. Chain Compromise takes advantage of trust between the vendor

05:57

and the consumer.

06:00

All right, so if you need additional time, please take a moment to pause the video. So this statement Supply chain compromise takes advantage of trust between the vendor and the consumer is a true statement. And the reason this is a true statement is because if I do business long term with a vest and I UCC cleaner,

06:20

if the compromise had not happened previously,

06:23

2017 18

06:25

then

06:27

you know I would not be suspicious of that tool. That tool has been around for a while. It's tried and true. People use it day in and day out,

06:34

so I would not think anything of downloading and using that tool.

06:39

But

06:40

I trust that vendor. And so if there is a relationship there where I have, I used dental equipment all the time, or I use HP equipment all the time or I use whatever

06:53

And for some reason let's just say a delivery is intercepted or they've got a dirty

07:00

worker in the factory, something of that nature. And they're putting chips in systems for money that you know, track data and send information back to a foreign entity.

07:10

Well, you know, the the vendor is still trying to do right by me. And I trust that vendor. I'm going to use their hardware, not think much about it until you know the articles come out that the chips are infected or whatever the case may be.

07:21

So definitely taking advantage of trust here.

07:25

So in summary.

07:27

All right. What did we go over today? What we described What is a supply chain compromise? We reviewed some examples of mitigation techniques. And what are some detection techniques as well. So with that in mind, I want to thank you for your time today.

07:45

And I look forward to seeing you again,