Third-party risk management
Third-party risk management is critical. If a critical vendor you rely on is compromised, then the breach may also affect your company. We have talked in Chapter 8 about using Snyk’s renovate package to ensure your open source code is up to date and patched. Also, use GitHub’s static application security testing (SAST) code scanning tool to ensure your code doesn’t have vulnerabilities. What if the tool you use has been compromised? This is exactly what happened with the SolarWinds attack. This is why third-party risk management, also known as supply chain management, is so critical.
SolarWinds attack
SolarWinds has a network Monitoring product called Orion. It was used throughout the commercial and federal government. SolarWinds suffered a major cyber-attack in 2020. What makes the SolarWinds attack so devastating is that the attackers were able to gain access to their source code and introduce malware that would allow them to...
