Lessons Learned from the Summer of Supply Chain Attacks
summary
Summer 2023 shows concrete patterns: an email gateway exploit (Barracuda) uses three malware families and temp file staging to exfiltrate data and hides backdoors in configuration updates; a MoveIt zero‑day hits over 2,000 victims who end up on victim shaming sites (50% learn from outsiders, 70% of ransomware victims hear directly from extortors); a cascading 3CX build compromise implants code into downstream installs. Defenses that matter: zero trust, targeted monitoring (temp file creation, config changes), stronger contracts, data deletion/encryption, tabletop testing and automated detection.
AI-written summary · about
chapters (17)
- 0:00Summer of supply chain attacks
- 1:24Supply chain attack examples
- 8:16Threat actor tactics
- 10:25Industry reaction and legal views
- 12:332024 cyber threat trends
- 15:44Government cyber expectations
- 19:59Global threat landscape
- 21:50Supply chain risk reduction
- 26:21Risk tolerance and incident response
- 32:18Overwhelming cybersecurity challenges
- 37:35Legal exposure and response
- 38:38Workforce training and social engineering
- 40:08Post-incident government engagement
- 41:32Q&A on open-source and contracts
- 44:20Contract management challenges
- 47:10Supply chain vs general attacks
- 49:00Regulatory liability and CEO accountability
related talks
50mThe World in Crisis: Prepare for Extreme Events via Supply Chain Resilience
51mThe Enemy Within: Modern Supply Chain Attacks
48mThe Five Most Dangerous New Attack Techniques
57mInsights and Predictions: What's Next in InfoSec
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
46mThe Rise of Malware Within the Software Supply Chain
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
36mBuilding a Trusted and Resilient Software Supply Chain