How Clean Email and Security Edge protect your supply chain?

All companies need to rely on others to build their business processes and to build the products and services they provide to their customers, with maximum quality and efficiency. These 'third parties' are their suppliers, partners, and collaborators, who supply them with materials, products or services. This is what we know as the supply chain.

The supply chain is a highly attractive target for cybercriminals. Many of the partner companies that make up the supply chain can often have entities that are less able to protect themselves against cyber threats, making them the weakest link in the security posture of the company they serve.

More and more attacks on companies are attributable to the exploitation of their suppliers' vulnerabilities. In these attacks, instead of launching a direct attack against the target company's systems, networks or employees, the attacker infiltrates an entity that is part of the supply chain to take advantage of the trust and access that entity enjoys in the target's systems.

⚠️ Not only direct suppliers or third parties should be of concern, but also fourth or nth parties. These are suppliers with whom we do not have a direct relationship, but who are linked to our direct suppliers, their suppliers or their suppliers' suppliers.

This complexity increases the attack surface and makes it difficult to manage third-party risks, as the security of the supply chain can be compromised by any link, no matter how remote it may appear.

The importance of protecting the supply chain

According to a study by the World Economic Forum, almost 40% of organizations have suffered negative effects due to cybersecurity incidents in their supply chain. Proofpoint' s research has recently revealed that 54% of Spanish organizations acknowledge having suffered an attack in their supply chain in 2023.

It is predicted that these problems will continue to rise in 2024, and that our reliance on external partners and suppliers will become one of the main channels of attack. Aware of this risk situation and its serious repercussions, the European Union has established regulatory frameworks such as NIS2 and DORA to strengthen cybersecurity measures and ensure supply chain security. Both regulatory compliances are forthcoming (NIS2 in October this year and DORA in January 2025), and emphasize suppliers:

• NIS2 provides that audits may be conducted on critical suppliers.
• DORA that all of them will need to comply with the regulations, under penalty of sanctions and impossibility of contracting.

✅ These and other measures are moving from mere recommendations to mandatory compliance. The companies concerned must comply with them, but so must their supply chain. Failure to do so will subject them to penalties and heavy fines.

How an email protection solution and Security Edge can help companies secure their supply chain

Supply chain attacks are becoming more frequent and sophisticated. To defend against them, organizations must ensure that their cybersecurity strategy includes people, processes and technology (both internally and from their partners).

The first step in establishing the supply chain cyber security strategy is to identify the communication channels between partners and our company.

• On the one hand, we have users of these suppliers directly accessing corporate information systems.
• On the other hand, it is still a fact that email is the most used channel for exchanging information between organizations.

Given this situation, it is clear that supply chain security must be addressed from both perspectives at the same time.

This is where technology can help. Implementing a specific solution for advanced email protection together with the capabilities of a Security Edge solution for access to corporate applications and the Internet will allow us to truly cover supply chain security.

Integrating Security Edge with solutions such as Clean Email enables you to strengthen access policies and protect your enterprise infrastructure against threats and security compromises.

The union of both technologies combined in a service offers the opportunity to take security to a higher level, based on the principles of the Zero Trust model linked to the user's identity, to manage and protect access to business applications and data.

While it is essential to implement technological security measures that cover all communications channels used in the supply chain, it is equally important that these technologies are managed in a uniform and coordinated manner to be effective.

✅ It is particularly important to have a highly qualified team of experts, capable of implementing a robust security posture, always up to date, as well as detecting and responding to any incident as quickly and efficiently as possible, limiting the impact on the organization as much as possible.

Clean Email and Security Edge

Clean Email

Clean Email protects the company against BEC (Business Email Compromise) attacks, data leakage, phishing, ransomware and other malware, phishing and spam. In addition, it identifies which users are most likely to become victims, detecting which are most frequently targeted by impostor or spoofing threats.

The service not only protects, but also focuses on early detection of potential compromises at providers, identifying suspicious emails from these accounts, which could indicate that they are at risk. In addition, it provides valuable information on the level of reliability and trustworthiness of suppliers, facilitating action against potential compromises.

Clean Email provides complete visibility into BEC threats, allowing you to identify vendor billing fraud and payroll diversion, for example.

Clean Email provides dashboards that allow you to visualize who your suppliers are and their level of risk in real time, whether its malicious messages being sent to your own company or to any other company in the world. With this valuable information, we can trigger, for example, workflows with additional security when exchanging confidential information.

Clean Email also ensures the confidentiality of communications with your suppliers by encrypting the confidential information and the communication itself, protecting it from prying eyes and establishing a secure channel of information exchange.

Security Edge

Security Edge provides a complete view and granular control of your employees' access to company assets through its Zero Trust access capabilities. It also incorporates relevant security indicators from the Clean Email solution (such as malicious IP addresses, suspicious domains or unusual behavior patterns), thus enforcing user access policies for both corporate applications and the Internet.

Security Edge acts proactively, blocking suspicious communications and ensuring that there is no unauthorized access.

Email is one of the main means of communication with suppliers and third parties in the supply chain. A service such as Clean Email can detect if supplier accounts have been compromised and by sharing this information with SSE, the access policy can be tightened or even block access from any compromised supplier account.

Advanced Cyber Security Management Solutions

Telefónica Tech has a team of certified and highly qualified experts who manage advanced solutions such as Clean Email and Security Edge in a centralized and coordinated manner, acting as a single point of contact for the customer.

This not only ensures early detection and a fast and accurate response, but also brings added value to the customer, maximizing efficiency and effectiveness in risk mitigation and protection of critical assets against cyberattacks.

Clean Email

• Detects and measures supplier compromise risk and prioritizes actions.
• Expedites investigations related to compromised third-party/supplier accounts.
• Provides global visibility into supplier risk, enabling proactive protection in anticipation of potential cyber-attacks.
• Supports regulatory compliance. E
• nables secure and encrypted communications to be established quickly and easily.

Security Edge

• Restrict access to systems and/or information by a supplier marked as high risk or with compromised accounts.
• Implements advanced data leakage controls (DLP) on vendor communications (Internet, SaaS, internal applications).
• Provides complete visibility of vendor access and powerful analytical tools

✅ Learn more about Clean Email and Security Edge

◾ Clean Email Business to protect SMEs from cyberattacks via email.
◾ Clean Email Enterprise for large companies.
◾ Security Edge end-to-end security from the cloud.

AUTHORS
DAVID MARTIN LINDSTRÖM
Global Head of Network Security

KATTERINE NODARSE
Email Security Product Manager

JOSÉ ANTONIO VELASCO
Product Manager

____

Cyber Security

The way we access data has changed. We must also change the way we protect it

January 23, 2024