The grocery chain Wegmans is suing one of its suppliers (Invermar) for a supply chain breach. Though all the details aren’t yet available, Wegmans claims that Invermar was compromised and that the compromise allowed attackers to reroute payments. Wegmans’ total losses aren’t known, though the suit asks for $900,000 in damages. When we talk about […]
Archive | Supply Chain Security
Threat Hunting Your Supply Chain
SCREATH Supply Chain Security Threat HuntingFrom the NotPetya attacks last year to the recent hijack of the MEGA browser plugin, it’s obvious that supply chain compromise isn’t just a theoretical risk anymore. But how do you threat hunt in an environment that isn’t your own? This is a difficult task, but we really focus on looking for the few indicators […]
Introducing SCREATH (Supply Chain Risk Framework)
SCREATH Supply Chain SecurityToday, I gave a talk at the SANS Threat Hunting Summit on Supply Chain Threat Hunting. I’ll publish slides later, but I wanted to post our supply chain threat hunting framework worksheet. I want to thank Brandon McCrillis (Rendition Infosec CEO) for freeing me up for the time to work on this (he also gave […]