Why a small supplier is a national security problem

The attacker who wants a defence contractor, a utility, or a government department doesn't always go through the front door. They go through the firm that does the air conditioning maintenance, or the payroll, or the component with a six-week lead time.

The logic

Large organisations have hardened. Their suppliers mostly haven't. A supplier with remote access, trusted email, or a place in the production chain is a route in, and compromising them is cheaper than compromising the target. For a state actor with time, it's the obvious play.

What that means if you're the supplier

You're a target because of who you serve, not because of what you have. The question to ask yourself is which of your customers would be worth attacking, and what access you have to them. That's your exposure, and it's probably larger than your own data would suggest.

What that means if you're the customer

Your supply chain is part of your attack surface. Questionnaires don't reduce it. The things that do: limiting what each supplier can reach, monitoring the access you've given them, knowing which suppliers are single points of failure, and having a plan for the day one of them is compromised.

Where governments are going

Regulation in several countries now pushes critical sectors to manage supplier risk explicitly, and the direction is toward more of it. Organisations that treat this as a compliance exercise will do the minimum. The ones that treat it as a real threat will do something that works.

I've spent a long time on the government side of this. If you're a supplier trying to understand what's expected, or an operator trying to get a grip on your supply chain, I can help.

Explore: More on national security and cyber conflict · Work with me