Following the news that the world’s largest chip manufacturer- The Taiwan Semiconductor Manufacturing Company (TSMC)- was forced to shut down production at the weekend, IT security experts commented below.
Ross Rustici, Senior Director for Intelligence at Cybereason:
There are some contract mechanisms that allow companies to pass the blame onto an afflicted supplier, but at the end of the day that has more to do with mitigating risk from the worst-case scenario then actually making the supply chain more secure. Ultimately, most companies are in the position where they’re so concerned with trying to make their own network secure, that they can’t think about or really affect the global supply chain upon which they rely. Companies are either faced with segmenting their networks in such a way that third-party dependencies are limited to the core business functions that they interact with, and pervasive access is not given, or the much larger burden of trying to force security upon all of its vendors in such a way that it complies with its own standards. This vertical security integration is not only unfeasible given the way global supply chains work but also onerous and costly, dramatically decreasing profits for the companies and eliminating the reason why these global supply chains were created to begin with.”
Thomas Nuth, Director of Product & Solutions at Nozomi Networks:
“While details of what actually happened and to which areas of the factory were affected have not been released, one thing that is obvious is that cyber criminals will be lurking in the shadows, learning from what worked and what didn’t ready for the next time they attack.
“Having the ability to identify any changes in operational activity is imperative to prevent outbreaks, such as that experienced by TSMC. What this will also do is identify if anything else might have been the attackers mission, other than the malware infection. We’re seeing instances where the obvious incursion (aka the virus) diverts focus while the true objective goes undiscovered until it’s too late.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.