Held in Breda, Netherlands, this year’s Cyber Resilience Day convened industry leaders and cybersecurity experts to address the topic of supply chain attacks and the latest digital threats. The event showcased a series of keynote speeches, panel discussions, and interactive workshops, equipping attendees with valuable insights and actionable strategies to strengthen their organizations’ cyber resilience.

A special thank you to all of our keynote speakers: Kelvin Rorive from the Cyber Chain Resilience Consortium (CCRC), Rob Bening, Advisor at Beyond Ideas, Henk Bijsterbosch from Samen Digitaal Veilig, Peter Lahousse, and Victor Acin from Outpost24. We appreciate you sharing your valuable insights into enhancing the cyber resilience of supply chains and effectively managing cyber crises. We’d also like to express our gratitude to Patrick van Velthoven for graciously hosting this event.

There were several key talking points relevant to any organization looking to improve their cybersecurity posture, ranging from defending against supply chain attacks to the latest regulatory requirements like NIS2/DORA. Here are five of the most valuable takeaways to keep in mind from Outpost24’s Cyber Resilience Day:

1. Rising supply chain threats

According to Outpost24’s KrakenLabs’ research, there’s been a recent and significant increase in threats targeting supply chains. These attacks are becoming more prevalent against private companies and open-source projects. Over the past year, more than 1.5 billion credentials were stolen and 245,000 malicious packages discovered worldwide

The nature of a supply chain attack involves exploiting a vulnerability in one organization and then using it as an entry point to further compromise their third parties. This type of attack targets organizations by focusing on weaker links in the supply chain, which includes all processes from material delivery to product distribution. It’s an effective method for attackers to steal sensitive data, gain access to secure environments, or take control over specific systems.

With the increasing prevalence of interconnected systems and businesses’ growing reliance on third-party vendors, supply chain attacks have surfaced as a major concern for organizations of all sizes. The SolarWinds hack in 2020 is perhaps the most infamous example of how devastating a mass supply chain compromise can be.

2. Common misconceptions about supply chain attacks

There are several common misconceptions about supply chain attacks. The first one being that they are only a concern for big corporations and that they don’t affect smaller businesses. Supply chain attacks can (and do) impact organizations of all sizes. These attacks can impact any industry that relies on a complex network of suppliers and vendors. Another misconception is supply chain attacks have to be extremely complex and intricate – they actually vary in complexity and some attacks can be considered simple in nature.

Supply chain attacks also aren’t merely confined to software vulnerabilities, but they can encompass intricate physical components and involve human elements that introduce additional layers of complexity and risk. However, it’s essential to know not every vulnerability within a supplier’s intricate system inevitably orchestrates a catastrophic supply chain attack.

3.  Practicing cyber crisis scenarios within the supply chain

Vulnerabilities in one part of the digital supply chain can disrupt an entire network. Organizations should be maintaining clear visibility and situational awareness of any vulnerabilities that may exist within the supply chain to reduce the likelihood of a potential attack. It’s key to be able to identify where the weaknesses are to make sure the right teams are prepared for dealing with an attack.

Regularly conducting cyber crisis simulations guarantees that stakeholders can respond effectively, thereby minimizing the impact of real cyber incidents. These simulations also help to promote a culture of continuous improvement and resilience. Involving various departments, such as IT, management, and communications, creates a comprehensive strategy that aligns the organization’s response to cyber threats.

Incorporating advanced tools into simulations increases realism and effectiveness, allowing teams to better understand and refine their response mechanisms. Post-simulation debriefing sessions allow the refinement of strategies and the sharing of insights, fostering transparency and collaboration across the supply chain. This proactive approach is crucial for safeguarding against and mitigating the impact of cyber incidents.

4. Importance of implementing the NIS2 Directive

The NIS2 Directive plays a crucial role in fortifying the cybersecurity of essential services in the EU’s digital realm. It expands upon the scope and regulations of the previous NIS directive, mandating organizations in critical sectors to conduct thorough risk assessments and provide regular reports. The directive places significant emphasis on supply chain security, requiring companies to maintain an inventory of suppliers and enforce stringent cybersecurity standards.

The NIS2 Directive also promotes cooperation and information sharing among member states and across different sectors. This collaboration is essential because it improves response to cyber threats and vulnerabilities. By adopting the NIS2 Directive, organizations not only strengthen their own cybersecurity measures but also contribute to the EU’s overall resilience against cyberattacks.

5. Operational resilience will lead to cybercrime resilience

The success of cyber resilience hinges on the commitment and collaboration of all stakeholders within the cybersecurity ecosystem. An operational resilience approach facilitates risk management through regular security assessments and audits. It also involves implementing appropriate technical and organizational measures to prevent and mitigate cyberattacks.

Operational resilience isn’t just limited to preventing cybercrime, but also includes the ability to quickly recover and respond in the event of a cyber-attack. This can involve having backup systems and data, as well as well-trained incident response teams. By being prepared for potential cyber threats, organizations can minimize the impact of such attacks.

How to discover weak spots in your attack surface?

Cyber Resilience Day 2024 not only highlighted the critical issues facing organizations today but also provided actionable insights and strategies to enhance cyber resilience. As we move forward, the lessons learned from this event will play a crucial role in shaping the future of cybersecurity strategies across industries. For those who missed the event or wish to revisit the discussions, stay tuned for updates and resources available on the Outpost24 website.

And if you haven’t already taken advantage of a free audit of your attack surface, don’t hesitate to book your analysis now.