Panel: Supply‑Chain and infrastructure resilience in the current landscape

Panel: Supply‑Chain and infrastructure resilience in the current landscape

Speakers: Gabriel Mihai Tanase (Partner, Cyber, KPMG Romania); Alex "Jay" Balan (CISO, Happening); Chris Kubecka (CEO, HypaSec); Johnny Xmas (President, Burbsec Information Security Network); Costin Burdun (Deputy CEO, certSIGN)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=Rkio3__oul4

Overview

In an era defined by increasing digital interconnectedness and escalating geopolitical tensions, the security of an organization's supply chain and underlying infrastructure has become paramount. This DefCamp panel, moderated by Gabriel Mihai Tanase of KPMG Romania, brought together a distinguished group of cybersecurity leaders to dissect the multifaceted challenges and strategic imperatives for building robust resilience. Alex "Jay" Balan (Happening), Chris Kubecka (HypaSec), Johnny Xmas (Burbsec Information Security Network), and Costin Burdun (certSIGN) offered diverse perspectives spanning offensive security, trust services, and global enterprise operations.

The discussion moved beyond theoretical compliance, delving into the practical realities faced by organizations managing thousands of suppliers across multiple countries. Panelists illuminated critical issues such as the pervasive problem of shadow IT, the complexities of procurement processes, the necessity of tailored risk assessments, and the often-overlooked ethical dimensions of supply chain management. The core message resonated clearly: true resilience demands a proactive, risk-informed approach that integrates security deeply into business operations, rather than treating it as a mere regulatory checklist.

The panel's insights are particularly timely given the recent surge in sophisticated supply chain attacks, exemplified by incidents like SolarWinds, which demonstrated how a single compromise deep within a supplier network can have catastrophic ripple effects across numerous organizations. The discussion underscored that understanding, assessing, and continuously monitoring the security posture of every entity in an organization's extended ecosystem is no longer optional but a fundamental pillar of modern cybersecurity strategy.

Background

▶ Watch: Panel introduction and speaker self-introductions (0:00)

The modern enterprise operates within a sprawling, interconnected ecosystem where reliance on third-party suppliers is not just common, but essential for core business functions. This extensive reliance, however, introduces significant supply chain attack surfaces that cybercriminals and nation-state actors are increasingly exploiting. As highlighted by the panelists, major incidents like the SolarWinds breach and localized attacks on critical infrastructure, such as the Romanian hospital system, serve as stark reminders of the devastating potential of compromised suppliers.

Several systemic issues contribute to this vulnerability. Firstly, procurement processes often prioritize cost-efficiency over stringent security vetting, leading to the onboarding of suppliers with inadequate security postures. Alex Balan pointed out the common scenario where shadow IT circumvents official procurement channels entirely, bringing unvetted suppliers and technologies into the organizational fold without any security oversight. Johnny Xmas further elaborated on the lack of clear, documented internal policies, which leaves employees and procurement teams without precise guidelines for supplier engagement, fostering inconsistent security practices.

Secondly, a significant challenge lies in the sheer diversity of suppliers. Organizations can range from large, compliant entities with robust security certifications (e.g., SOC 2, ISO 27001) to small startups or even non-IT vendors (like chemical suppliers or cleaning services) who may lack fundamental cybersecurity awareness. Imposing a uniform, "ask for the moon" set of security requirements on all suppliers is impractical, costly, and often leads to friction or circumvention. This necessitates a more nuanced, risk-based approach that considers the specific context, data handled, and potential impact of each supplier relationship. The panel also touched upon the complexities introduced by regulatory compliance frameworks like NIS and DORA, which, while important, can sometimes lead to a checkbox mentality rather than genuine security improvements if not properly contextualized.

Key Findings

▶ Watch: Internal frameworks for consistent supplier security controls (6:20)

The panel discussion coalesced around several critical findings that challenge traditional approaches to supply chain security and offer a more pragmatic, effective roadmap for resilience:

• Beyond Compliance, Towards Resilience: A recurring theme was the imperative to move past a "checkbox" compliance mentality. As Alex Balan succinctly put it, the goal should be "security not compliance." While regulations like NIS and DORA provide a baseline, true resilience requires a deeper understanding of risk and proactive mitigation strategies that enable organizations to "sleep well" regarding their suppliers.
• Internal Frameworks and Granular Policy: Johnny Xmas emphasized the development of detailed internal frameworks that define security requirements based on the type of data handled (e.g., intellectual property, PII), who provides and consumes it, and how it's transmitted. This allows for consistent, easily consumable, and enforceable policies that streamline contract development and testing, significantly reducing shadow IT.
• Risk-Based Supplier Assessment: The panelists advocated for tailoring security requirements to the actual business impact and criticality of each supplier. Instead of demanding "rock-solid security" from every vendor, organizations should assess what is truly necessary based on the data or services provided. This involves cross-functional collaboration between business owners, procurement, legal, IT, and security teams to define appropriate controls.
• Assume Compromise: A fundamental shift in mindset recommended by Alex Balan is to operate under the assumption that any supplier "could be or actually will be breached." This assume compromise context drives defensive design, focusing on damage limitation, isolation (e.g., segregating supplier access), and proactive alerting logic to detect and respond to incidents.
• "What Problem Are You Trying to Solve?": Johnny Xmas introduced this "magical phrase" as a crucial self-assessment for security teams. By clearly defining the specific problem a security requirement addresses, teams can avoid unnecessary demands on suppliers and ensure their efforts are focused and justifiable, thereby fostering better relationships and cooperation.
• Mitigation for Unavoidable Uncompliant Suppliers: Recognizing that organizations are sometimes "forced to adopt an uncompliant supplier" (e.g., due to market monopolies, regulatory mandates, or geopolitical realities), the panel stressed the importance of risk mitigation. Strategies include rerouting insecure traffic (e.g., from FTP to SFTP), implementing extra monitoring, and segmenting data flows to limit exposure.
• Security as an Enabler, Not a Blocker: The consensus was that security teams should adopt a "yes, and" approach. Instead of simply saying "no" to business initiatives, security should work with business owners to find secure ways to achieve their goals. This collaborative approach prevents shadow IT and builds trust, making security an integrated partner rather than an impediment.
• Emerging Importance of ESG: The discussion briefly touched upon Environmental, Social, and Governance (ESG) considerations, particularly the "Social" aspect, including ethical labor practices (e.g., child labor). While challenging to audit, integrating ethical guidelines into supplier contracts reflects a broader corporate responsibility beyond pure cybersecurity.

Technical Deep Dive

▶ Watch: Johnny Xmas: 'What problem are you trying to solve?' (26:00)

While a panel discussion, the speakers provided rich technical and procedural insights into managing supply chain risk, emphasizing frameworks, methodologies, and architectural considerations rather than specific code.

A cornerstone of effective supply chain security, as articulated by Johnny Xmas, is the development of internal frameworks. These frameworks go beyond generic public standards like SOC 2 or ISO 27001 by providing granular, company-specific guidelines. They categorize data types (e.g., intellectual property, PII), define data providers and consumers, and specify transmission methods. Based on these parameters, the framework dictates the precise security controls required for each supplier relationship. This approach not only allows for boilerplate contract language but also ensures consistency in testing and assessment across the organization. For instance, a supplier handling sensitive manufacturing recipes would face different controls than one managing public-facing website content.

Alex Balan highlighted the importance of guard rails within the supplier onboarding process. These involve integrating multiple internal departments, such as legal and intellectual property (IP) teams, to ensure that critical steps are not bypassed. For example, any supplier requiring a DNS entry or infrastructure allocation must first go through a change management process and complete a data protection questionnaire, with legal ensuring contractual obligations are met. This multi-layered approval system helps prevent shadow IT from establishing unvetted connections.

The panel stressed a proactive risk assessment methodology centered on the impact to the business. This involves asking: "What would happen if this [supplier, system, data] were breached?" Alex Balan explicitly recommended an assume compromise context, where security organizations design their defenses, monitoring, and incident response with the expectation that breaches will occur. This leads to architectural decisions like data segregation and isolation for suppliers. For example, if a GitHub repository is being used by a supplier, ensuring it is properly segregated prevents a breach in that specific area from spreading laterally across the organization's broader infrastructure.

Chris Kubecka introduced the bow-tie method, a risk analysis technique commonly used in high-consequence industries like nuclear facilities. This method visually maps out potential threats, their causes, and their consequences, along with all the preventative and mitigating controls in place. For supply chain security, this means identifying specific risks (e.g., a critical supplier being compromised), mapping out the various attack vectors, and then detailing all the technical and procedural safeguards (preventative barriers) to stop the attack, as well as the recovery and mitigation measures (recovery barriers) to limit damage if a breach occurs. This comprehensive approach is particularly valuable for addressing complex geopolitical risks, such as nation-state commandeering of manufacturing facilities, as discussed by Johnny Xmas.

Regarding incident response, the panelists underscored that supplier contracts must clearly define responsibilities beyond mere liability clauses. They should specify communication protocols, outlining how and when a supplier must notify the organization of an incident, even if the organization is not directly impacted initially. Furthermore, contracts should stipulate mutual support mechanisms, where both parties agree to assist each other in managing and resolving incidents. The primary objective during an incident is crisis management and business recovery, with liability discussions reserved for post-incident learning and improvement.

Finally, the discussion covered continuous monitoring of suppliers. Beyond initial onboarding assessments, organizations need ongoing processes to verify compliance (e.g., regular checks for updated ISO 27001 certifications) and technical posture. While acknowledging the nascent state of dedicated supply chain management platforms and vendor management platforms, the panel emphasized tailoring monitoring efforts to the specific criticality and services provided by each supplier, rather than applying a one-size-fits-all solution. This continuous vigilance ensures that security posture does not degrade over time and that emerging risks are identified promptly.

Demo / Proof of Concept

▶ Watch: Strategies for non-compliant suppliers and risk mitigation (30:00)

As a panel discussion featuring multiple speakers sharing insights and experiences, this talk did not include a live demonstration or proof of concept. Instead, the speakers presented real-world scenarios, practical strategies, and conceptual frameworks derived from their extensive professional backgrounds.

Defensive Implications

▶ Watch: Continuous monitoring approaches for supplier security (58:00)

The insights gleaned from this panel offer critical guidance for organizations aiming to bolster their supply chain and infrastructure resilience:

• Develop and Document Granular Internal Frameworks: Prioritize creating clear, written policies and procedures that define security requirements for supplier engagement based on data classification, transmission methods, and business criticality. These frameworks should be easily digestible by non-technical teams, including procurement and legal, to ensure consistent application and reduce shadow IT.
• Implement a Robust, Risk-Based Third-Party Risk Management (TPRM) Program: Move beyond generic compliance. Conduct thorough risk assessments for all suppliers, explicitly identifying the potential business impact of a compromise. Tailor security requirements to this risk profile, rather than demanding uniform, excessive controls from every vendor.
• Adopt an "Assume Compromise" Mindset: Design and implement security architectures with the expectation that suppliers will eventually be breached. Focus on damage limitation through data segregation, network isolation, and robust monitoring capabilities that can detect anomalous behavior emanating from supplier connections.
• Foster Cross-Functional Collaboration: Break down organizational silos. Ensure cybersecurity, procurement, legal, business owners, and IT are all at the table when assessing, onboarding, and managing suppliers. This collaborative approach ensures that security requirements are aligned with business needs and contractual obligations.
• Educate and Raise Awareness: Conduct ongoing training for internal teams (especially procurement and business units) on the risks of shadow IT and the importance of adhering to supplier security policies. Additionally, work with suppliers to raise their cybersecurity awareness, particularly smaller entities who may lack dedicated security resources.
• Prepare for Geopolitical and "Black Swan" Events: Integrate scenarios like nation-state aggression, sanctions, and large-scale infrastructure outages (e.g., AWS crashes) into Business Continuity (BC) and Disaster Recovery (DR) plans. This includes developing exit strategies for critical suppliers, identifying alternative vendors, and implementing technical measures like emergency encryption key deletion for sensitive IP in high-risk regions.
• Embrace a "Yes, And" Approach to Security: Position the security team as an enabler of business, not a blocker. When confronted with requests that pose security risks, actively work with business units to find secure alternatives or mitigations, rather than issuing outright denials. This builds trust and reduces the likelihood of teams bypassing security protocols.
• Integrate Ethical Considerations (ESG) into Supplier Vetting: While challenging, organizations should define their ethical standards (e.g., regarding child labor, fair wages) and incorporate them into supplier contracts and audit processes. This reflects a growing emphasis on corporate social responsibility and can mitigate reputational risks.
• Establish Continuous Monitoring: Beyond initial onboarding, implement processes for ongoing verification of supplier compliance and security posture. This may involve leveraging supply chain monitoring providers or vendor management platforms, but should always be tailored to the specific risks and services associated with each supplier.

Key Takeaways

• Shift from Compliance to Risk-Based Resilience: Prioritize understanding and mitigating actual business risks over merely checking regulatory boxes (e.g., NIS, DORA).
• Develop Granular Internal Frameworks: Create specific, documented policies for supplier security based on data type, flow, and criticality to ensure consistency and reduce shadow IT.
• Assume Compromise and Isolate: Design defenses and monitoring with the expectation of supplier breaches, focusing on damage limitation through data segregation and network isolation.
• Foster Cross-Functional Collaboration: Engage business, procurement, legal, IT, and security teams in a unified approach to supplier assessment and management.
• Mitigate Unavoidable Risks: For essential but uncompliant suppliers, actively implement risk mitigation strategies (e.g., secure communication channels, extra monitoring, segmenting data).
• Security as an Enabler: Adopt a "yes, and" approach, working with business units to find secure solutions rather than blocking initiatives, thereby preventing circumvention.
• Integrate ESG and Geopolitical Risks: Broaden supplier vetting to include ethical considerations and prepare for potential disruptions from nation-state actions or other "black swan" events.

About the Speaker(s)

• Gabriel Mihai Tanase: A Partner in Cyber services at KPMG Romania, Gabriel brings almost 25 years of experience in cyber services and projects, moderating the panel with deep industry insight.
• Johnny Xmas: Global Head of Offensive Security for one of the world's largest food and beverage manufacturers, Johnny has 25 years in IT, 18 in information security, and 12 in offensive security. He is also the President of Burbsec Information Security Network.
• Costin Burdun: Deputy CEO at certSIGN, a trust services and cybersecurity service provider operating internationally.
• Alex "Jay" Balan: Chief Information Security Officer (CISO) for the Happening supergroup, managing security across 10 countries with over 7,000 suppliers in a challenging business line.
• Chris Kubecka: CEO of HypaSec, former Distinguished Chair of the Middle East Institute's Cybersecurity and Emerging Technology program, and a strategic partner of the EY Bridge EU board. She brings extensive experience in critical infrastructure and geopolitical cybersecurity.