Industry Voice - When regulation isn’t enough: It’s time to hold vendors to account

The UK government’s much anticipated Cyber Security and Resilience Bill has just entered parliament.

The regulation places stricter controls on around 1500 organisations in the UK, and has been expanded to cover select Managed Service Providers (MSPs), who have a turnover exceeding €10 million and employ at least fifty members of staff.

Any organisation failing to adopt security best practices will face significant fines, with relevant competent authorities holding them to account.

While it’s still some time before the Bill moves from policy to implementation, the big question is, will it be enough to protect the UK from growing cyber threats?

The prevalence of enduring attacks

Cyber attacks are undoubtedly growing in frequency and cost, while organisations are feeling their enduring impacts long after an immediate incident.

In November, Marks and Spencer announced its profits more than halved as a result of its cyber attack, and six months on it is still in a state of recovery.

It is vital the private and public sector work harder to improve our defences and resilience against these incidents.

But, in reality, many of today’s attacks can’t be blamed entirely on an organisation’s failure to adopt specific controls.

In many cases, an organisation can prioritise its own defences, but it’s the very technology it relies on to safeguard its environment that leaves it exposed.

Faulty foundations

While vulnerabilities in technology platforms are inevitable, questions must be raised around why the same types of vulnerabilities appear in the same vendor products year after year.

Every year, the Cybersecurity and Infrastructure Security Agency (CISA) releases a list of the top ten exploited vulnerabilities in technology platforms, and every year the vendors are the same.

These vulnerabilities will be Zero Days, or heavily exploited bugs that put organisations across the globe at serious risk.

They will often be tied to ransomware campaigns or massive data breaches, exposing highly sensitive data to nefarious actors.

VPNs, which are marketed to prevent malicious access will often exhibit vulnerabilities which facilitate it. While firewalls and gateway products are routinely shipped with vulnerabilities, which provide root or privileged access to systems for criminals to exploit.

Ultimately, these platforms are leaving organisations exposed.

Isn’t it time their vendors are held to account?

Oracle E-Business Suite Zero Day

Over the last few months, organisations have suffered a series of attacks after the Cl0p ransomware group exploited a critical Zero Day vulnerability in Oracle’s E-Business Suite (EBS), allowing the theft of sensitive data from global brands.

To amplify the attack’s impact, and secure a higher potential of payout, the threat actor then targeted senior leaders at impacted organisations demanding payment or threatening to leak their data.

Overall organisations spanning from GlobalLogic to the Washington Post have been affected, with their critical data compromised and now leaked online.

When it comes to these types of Zero Days, is it fair that organisations are penalised when it’s the software they depend on that’s the culprit of the attack?

While the ‘perfection’ mirage is long diminished from the world of cyber, this doesn’t mean that an acceptance of imperfection should allow us to overlook flaws in vendor products.

Furthermore, why should organisations continue to suffer the financial penalties of ransomware, when the vendors of products with exploitable vulnerabilities get off unscathed?

Regulation alone can’t drive resilience

From a channel and MSP perspective, there is a lot to be gained from calling these vendors to account.

With more MSPs falling into the scope of regulatory oversight, they soon could face fines for breaches that escalate across to their customer ecosystem.

MSPs and organisations must demand more from vendors, calling them to account when things go wrong. Otherwise, these vulnerabilities will continue to cause wide-scale damage and it will be organisations and MSPs dealing with the repercussions.

Holding software vendors and their leadership accountable is essential to building better, more secure products that collectively drive resilience.

At a minimum, organisations and governments must demand that product vendors conduct continuous offensive testing on their products, and automated patching and advanced security features should be offered by all vendors, as standard.

Otherwise, the foundations on which organisations, and MSPs, rely on will be inherently insecure, and it’s safe to assume no piece of legislation will ever be capable of delivering any real improvements towards resilience.

This post is sponsored by CybaVerse.