The Reality of Supply-Chain Attacks and Six Measures Companies Should Take

Supply-chain attacks are methods that expand harm not by directly penetrating the target company but by going through suppliers, contractors, or dependencies such as software and SaaS. The article categorizes them into three types: business-type (via contractors), software-type (abuse of updates or contamination of OSS), and service-type (via cloud/SaaS). Representative examples include the 2020 SolarWinds incident (malicious code injected into Orion updates, affecting about 18,000 organizations) and the 2022 Toyota–小島プレス工業 case (production stoppage with an impact equivalent to about 13,000 vehicles).

Domestic examples include the May 2024 ransomware incident at printing and mailing vendor イセトー, which resulted in the leakage of about 1.5 million personal records and caused secondary damage to the contracting municipalities and companies; the June 2024 ransomware attack on the KADOKAWA Group, which caused service outages and data leaks; and the 2023 shutdown of the Nagoya Port container terminal (approximately three days). These incidents show ripple effects across industries.

Countermeasures need to be organized across three layers: "internal," "vendor management," and "software management." The article stresses the importance of managing supply-chain risk at the executive level in line with the "Govern" concept newly introduced in NIST CSF 2.0, and it explains regulatory trends such as the METI SCS assessment scheme (★3: 26 requirements, 81 assessment criteria; ★4: 43 requirements, 153 assessment criteria).

Six specific measures that IT departments can implement starting today are: (1) the principle of least privilege, (2) enforcement of multi-factor authentication (MFA), (3) detection and elimination of shadow IT, (4) vulnerability management for software and libraries (leveraging SBOMs), (5) network segmentation and zero-trust design, and (6) collection of audit logs and anomaly detection. In addition, operational practices recommended for vendors include regular evaluations, explicitly stating security requirements in contracts, and managing subcontracting.

The article emphasizes deciding concrete operational procedures and responsibility assignments (for example, who collects logs, who updates policies, who checks vendors), and highlights the importance of SaaS visibility and access management to prevent shadow IT and residual access for departed employees. It concludes with an introduction to Josys’s SaaS management features.