Five security questions every defence supplier should be asking

Defence programmes depend on a wide network of organisations, many of which hold sensitive information, provide specialist capabilities or deliver services that would be difficult to replace. 

Software developers, engineering firms, manufacturers, technology companies and specialist suppliers can all play an important role in keeping programmes running. That also makes them relevant to anyone looking to gain access, obtain information or cause disruption. 

An attacker may find it easier to target a specialist supplier than a prime contractor. A cyber attack could stop production, a compromised employee could expose intellectual property or the failure of a single supplier could delay delivery across an entire programme. 

For organisations supporting defence programmes, security needs to go further than protecting IT systems or achieving certification. They need to know what their delivery depends on, where they are exposed and what would happen if something went wrong. 

Here are five areas worth looking at.

1) Understand why your organisation might be targeted

An attacker looking for access to a defence programme may not need to target the prime contractor directly. An engineering subcontractor could hold technical specifications, intellectual property or access credentials that provide another route to the information or capability they want. 

For suppliers, the important question is what makes your organisation useful to an attacker. It could be the information you hold, access you provide, specialist knowledge within your team or your role in keeping a programme running. 

Three questions to consider 

• What information, intellectual property or capabilities do we hold that could be valuable to an attacker?  
• Who might have an interest in obtaining that information or disrupting our operations?  
• Could our organisation provide a route into a defence customer or another supplier?  

Where to start – Assess the threats associated with your role in the defence programme. Identify what an attacker might want, how they could attempt to obtain it and where your existing security arrangements may be vulnerable.

2) Protect what matters to defence delivery

For some suppliers, the greatest concern will be the compromise of sensitive information or intellectual property. For others, it might be the loss of specialist manufacturing equipment, a secure facility or an engineer whose knowledge of a critical system isn’t documented anywhere else. 

A security review focused primarily on IT systems may overlook physical access to sensitive facilities, the access given to contractors and third parties, or equipment that cannot easily be replaced. 

Three questions to consider 

• Do we know which information, systems, facilities and people are essential to our defence commitments?  
• Have we considered physical security and insider risk alongside cyber security?  
• Do we know where sensitive information is held, who can access it and how it is shared with third parties?  

Where to start – Identify the assets and capabilities your defence commitments depend on. For each of them, establish what would happen if it became unavailable or compromised, then review the security arrangements protecting it.

3) Identify your critical dependencies

A specialist manufacturer might rely on a single supplier for a critical component. A software developer may depend on an external hosting provider. A logistics company may rely on systems and infrastructure operated by several third parties. 

The suppliers you spend the most with are not necessarily the ones that matter most to delivery. A relatively small provider could still create a serious problem if its service cannot quickly be replaced. 

Four questions to consider 

• Which suppliers and third parties are essential to our defence commitments?  
• What access do they have to our information, systems or facilities?  
• How long could we continue delivering if a critical supplier became unavailable?  
• What level of assurance do I need from suppliers? 

Where to start: Map the suppliers and services behind your critical defence activities. Identify any that cannot easily be replaced and establish whether alternative arrangements would work in practice.

4) Test your response to disruption

The real test of an incident response plan is what happens when people have to use it. 

A ransomware attack could stop production. A physical security incident could make a facility unavailable. A compromised supplier could expose sensitive information or interrupt delivery. 

In each case, decisions may need to be made quickly and before you have the full picture. Who takes control? What needs protecting first? When should defence customers be informed? How long can critical activities continue? 

Three questions to consider 

• Have we tested our response to incidents that could realistically affect our organisation?  
• Are responsibilities and decision making arrangements clear?  
• Have we tested our ability to recover systems and restore critical operations?  

Where to start: Run an exercise based on a credible incident, involving the people who would make the decisions, including senior leadership where appropriate. Use the exercise to identify where the plan breaks down, then assign responsibility for fixing those gaps and test it again.

5) Know what you can demonstrate to your defence customers

Defence customers may ask for evidence that security arrangements have been assessed, tested and improved, rather than relying on policies or certifications alone. 

That evidence might include the results of an incident exercise, remediation following a security assessment or a clear view of the suppliers your delivery depends on. The important point is being able to show what has been tested, what was found and what changed as a result. 

Three questions to consider 

• Can we demonstrate that our security arrangements reflect the risks associated with our defence commitments?  
• Do we have evidence that our incident response and recovery arrangements work?  
• Can we show how identified weaknesses are being addressed?  

Where to start: Identify three areas where you would struggle to provide convincing evidence of your security or resilience. Establish what assessment, testing or improvement is needed to address them. 

Five questions every defence supplier should be able to answer

1) Understand your threats

If an attacker wanted access to our defence-related information or capabilities, where would they start?

2) Protect what matters

Do we know which information, people, systems and facilities are critical to our defence commitments?

3) Review dependencies

Which supplier or external service could prevent us from delivering if it became unavailable?

4) Test your response

When did we last test our ability to respond to a significant incident and what did we learn?

5) Demonstrate readiness

What evidence could we provide a defence customer tomorrow to demonstrate our security and resilience? 

Any question that is difficult to answer is a useful place to start looking more closely. 

How Toro Solutions can help 

Toro works with organisations across the defence supply chain to understand where they are exposed, test whether existing security arrangements work and address weaknesses that could affect security or delivery. 

Our Defence Readiness & Security Assurance services cover three areas: 

• Cyber assurance: Security reviews, penetration testing, certification support and security improvement programmes. 
• Operational resilience: Identifying critical capabilities and vulnerabilities, reviewing business continuity arrangements and testing how organisations would respond to disruption through Red Team exercises and crisis management scenarios. 
• Supply chain assurance: Identifying critical third-party dependencies, assessing the risks they create and improving visibility across the supply chain. 

Where the risk crosses cyber, physical or organisational boundaries, we can bring those disciplines together rather than assessing each in isolation. 

Find out more about Toro’s Defence Readiness & Security Assurance services or speak to our team.