In the history of cyber security, there are attacks that forever change the way we think about threats. The SolarWinds software incident was one of them. Instead of attacking hundreds of companies one at a time, hackers broke into a single, trusted software vendor and inserted malicious code into its official update. As a result, thousands of customers around the world, including government agencies and major corporations, confidently installed a backdoor for attackers at their sites. This incident, although it involved the IT world, became a powerful warning to the entire industry.
In the world of operational technology (OT), where hardware and software are often viewed as closed, “black boxes,” supply chain risks are even greater and much more difficult to manage. The shiny new PLC, HMI panel or industrial robot that just arrived at your factory is an extremely complex product, consisting of hundreds of hardware components and thousands of lines of code from dozens of sub-suppliers. Are you absolutely sure that each of these components is safe?
This problem has been recognized and elevated to the top of the agenda by regulators. The new NIS2 directive imposes a direct obligation on industrial companies to manage risk throughout the lifecycle of their systems, with a special focus on supply chain security. This is no longer “good practice” - it’s a legal requirement. Understanding how to vet, contract and deploy technology from external partners has become a core competency in building viable digital resilience.
Shortcuts
- Why might the biggest enemies of your OT network come in a box from a trusted vendor?
- What is a supply chain attack and why is it so difficult to detect?
- How does the long life cycle of industrial equipment compound the risk of inherited vulnerabilities?
- How does the NIS2 directive force companies to take responsibility for the security of their suppliers?
- Step One: What security questions should you ask the supplier before you sign a contract?
- What is an SBOM (Software Bill of Materials) and why should it be required of any supplier?
- What cyber-security clauses should be included in any procurement contract?
- Step Two: How to perform secure acceptance testing of a new device before plugging it into the network?
- The Life Cycle of a Safe Supply Chain in OT.
- Step Three: How do you monitor and manage the security of the device throughout its lifecycle?
- How do you build a partnership with a vendor in responding to new vulnerabilities?
- Step Four: Why is safe disposal of OT equipment as important as purchasing it?
- How to create a comprehensive supply chain risk management program?
- How can nFlo help you audit and secure your OT supply chain?
- Are you as secure as your weakest link, which is your supplier?
Why might the biggest enemies of your OT network come in a box from a trusted vendor?
Trust is the currency on which business relationships are based. We trust that a reputable, long-established machine manufacturer will provide us with a top-quality product that is not only efficient, but also safe. Unfortunately, in today’s complex manufacturing ecosystem, even a supplier’s best intentions may not be enough to protect us from risk.
The problem is that the manufacturer of the robot you are buying is itself a customer of dozens of other companies. It uses operating systems, open-source libraries, chips and communication modules from its own suppliers. Each of these elements in the chain is a potential point where a vulnerability can be introduced - whether unintentionally, through programmer error, or intentionally, through an attack on one of the sub-suppliers.
As a result, when you buy a new device, you inherit all the accumulated technology debt and security risk from its entire supply chain. Even if your direct supplier has excellent security practices, you cannot be sure of the quality of the components it uses. That’s why new, pre-packaged hardware may contain outdated, vulnerable software or, in the worst case, deliberately implemented back doors.
📚 Read the complete guide: OT/ICS Security: Bezpieczeństwo systemów OT/ICS - różnice z IT, zagrożenia, praktyki
What is a supply chain attack and why is it so difficult to detect?
A supply chain attack is a sophisticated technique in which attackers, instead of directly storming a well-protected fortress (your company), focus their efforts on one of its less protected but trusted partners (your supplier). The goal is to compromise the supplier’s product or service so that it becomes a vehicle for attacking all its customers.
There are many variations of such attacks. It could be the aforementioned injection of malicious code into software updates (as in the case of SolarWinds). It could be the installation of malicious firmware on chips during the manufacturing process. It could also be the theft of cryptographic keys or certificates from the vendor, which are then used to sign the malware so that it looks legitimate and trusted.
These types of attacks are extremely difficult to detect using traditional methods. The software comes from a legitimate, trusted source and is often digitally signed. Anti-virus systems and firewalls have no reason to raise the alarm. Attackers enter our network through the “main gate,” greeted by guards rather than jumping over the wall. This makes an attack on the supply chain one of the most insidious and dangerous forms of cyberattacks.
How does the long life cycle of industrial equipment compound the risk of inherited vulnerabilities?
The nature of operational technology further compounds supply chain risks. The long life cycle of OT equipment, often exceeding 20 years, means that decisions made by developers a decade ago still have consequences today. The PLC we buy new in 2025 may still be running on an open-source library in which a critical vulnerability was discovered only yesterday.
To make matters worse, the development and certification process for industrial equipment is very long and complicated. Once a product is designed and tested, it is often not modified for many years to avoid disrupting its stability and incurring recertification costs. This means that even if a vulnerability is discovered in a component used by a manufacturer, it may not be able or willing to issue an appropriate fix, especially for older models.
As a result, we buy a device that is already “vulnerable by definition” (vulnerable by design) at the time of installation. It has security vulnerabilities that will never be patched. Without awareness of these vulnerabilities, and without a proactive strategy to manage these risks, we are introducing a ticking time bomb into the heart of our plant.
How does the NIS2 directive force companies to take responsibility for the security of their suppliers?
Understanding the seriousness of this threat, the NIS2 Directive introduces a revolutionary change, placing direct emphasis on companies’ responsibility for the security of their supply chain. Article 21 of the directive requires key and important players to implement technical and organizational measures to manage security risks in the processes of acquiring network and information systems and their components.
In practice, this means that companies can no longer ignore the security practices of their partners. They must implement a formal risk assessment process for their direct hardware and software suppliers. They must consider not only the price and functionality of the product, but also the quality of the vendor’s cybersecurity practices, its incident response capabilities and vulnerability management policies.
Moreover, this responsibility extends throughout the life cycle of the supplier relationship. Companies must ensure that their contracts contain appropriate security clauses, as well as monitor whether suppliers are actually adhering to agreed-upon standards. NIS2 effectively ends the era in which security was a problem disposed of on the basis of “it’s not our equipment, it’s the suppliers’.” From now on, it is your shared problem and your shared responsibility.
Step One: What security questions should you ask the supplier before you sign a contract?
Risk management in the supply chain begins long before the equipment is installed - as early as the purchasing process. Before you select a supplier, you need to treat it as a top-trust candidate and conduct a detailed “security interview” with it.
Ask a potential vendor to provide information about its security program. Ask if it has certifications, such as ISO 27001. Find out if it follows the principles of a secure software development lifecycle (Secure SDLC) - are its developers trained in secure coding, is the code subject to regular security reviews and testing?
Also ask about how the company manages vulnerabilities in its products. What is the vulnerability reporting process? What is the guaranteed response time for reporting a critical vulnerability? Does the company publish security bulletins? Finally, ask about its own supply chain - how does it verify the security of the open-source and commercial components it uses in its products? The answers to these questions (or lack thereof) will tell you a great deal about the vendor’s maturity and approach to security.
What is an SBOM (Software Bill of Materials) and why should it be required of any supplier?
One of the most powerful tools you can use when talking to a vendor is to request a SBOM (Software Bill of Materials), or “list of software components.” An SBOM is a formal, structured list of all the components that make up a piece of software - both commercial and open-source libraries.
Having an SBOM is like getting a detailed list of ingredients on a food label. It gives you full transparency and allows you to assess the risks yourself. When a critical vulnerability is reported in a popular open-source library (such as Log4j), you no longer have to wait for an announcement from your vendor. You can independently and immediately check in SBOM whether your industrial device is using this vulnerable library and take mitigating actions right away.
Requiring SBOM from suppliers is becoming the new industry standard and is being strongly promoted by government agencies around the world. This sends a clear signal to the market: we expect transparency. Suppliers who are able to provide SBOM demonstrate their maturity and confidence in the quality of their software. Those who refuse to do so should arouse our special caution.
What cyber-security clauses should be included in any procurement contract?
Conversations and assurances are important, but ultimately what counts in a business relationship are the provisions in the contract. Any contract for the purchase of OT hardware or software should include a dedicated addendum or section on cyber security that precisely defines the duties and responsibilities of both parties.
The contract should commit the supplier to certain security standards in the product development process. It should include a guarantee to report all discovered vulnerabilities and security incidents involving the product within a well-defined period of time. It must also define a support period during which the supplier commits to providing security patches.
The right to audit is also an extremely important clause. You should ensure that you can conduct (or have commissioned) independent security tests of the product you are buying, both before deployment and during operation. Finally, the contract should clearly define the limits of liability should a security incident result from negligence on the part of the supplier. Strong contract provisions are a powerful tool for enforcing due diligence on your partners.
Step Two: How do you perform secure acceptance testing of a new device before plugging it into the network?
Even if you have done a thorough vetting of the supplier and signed a solid contract, the “trust but verify” rule still applies. No new device should be plugged directly into the production network. It must first pass the Security Acceptance Testing (SAT) stage in an isolated lab or test environment.
During SAT testing, the device should undergo a detailed scan for vulnerabilities. Its configuration should be verified, checking that unnecessary services are not enabled and that default passwords have been changed. This is also the ideal time to verify that the supplied SBOM is up to par.
Analysis of network behavior is also a key part of testing. The device should be connected to a test network with monitoring to see what it is trying to communicate with. Is it trying to connect to any unexpected servers on the Internet? Is it sending unencrypted data? Only after all the tests have passed and the configuration has been hardened (hardening) can the device be allowed to be installed in a production environment, preferably in its own isolated network segment.
The Life Cycle of a Safe Supply Chain in OT.
PhaseKey ActionTarget**1. procurement (Procurement)**Detailed supplier verification, SBOM requirement, strong clauses in the contract.Choosing a trusted partner and minimizing risks right from the start.2 ImplementationAcceptance tests in isolation, hardening, placing in a separate segment.Verify and secure equipment before connecting it to production.**3. operation (Operation)**Continuous monitoring, vulnerability management, upgrade planning.Maintaining the safety of the device during its years of operation.**4 Disposal (Decommissioning)**Secure erasure of data and configuration.Preventing the leakage of confidential information at the end of product life.
Step Three: How do you monitor and manage the security of the device throughout its lifecycle?
The security work does not end at deployment. It continues throughout the entire, multi-year life cycle of the device. It is critical to include the new asset in a continuous security monitoring program. Network traffic to and from the device should be continuously analyzed by IDS/IPS systems for anomalies or attempted attacks.
You should also subscribe to security bulletins from your vendor and regularly check public vulnerability databases (CVEs) to stay abreast of newly discovered vulnerabilities that may affect your equipment. Any new significant vulnerability must trigger an internal process of risk analysis and implementation of appropriate compensating controls.
It is also important to maintain a good relationship with the supplier. Regular communication allows for quick information on planned updates and support in solving problems. A good partnership is based on mutual understanding and cooperation to ensure long-term security.
How do you build a partnership with a vendor in responding to new vulnerabilities?
The relationship with the supplier should not be an antagonistic one, but a partnership. Both parties share a common goal: to ensure the safe and reliable operation of the product. Instead of treating the supplier as a potential enemy, it is worth building an alliance with him based on open communication and clearly defined expectations.
Establish a clear and simple channel of communication with the supplier on security issues. Designate specific contacts on both sides (Security Point of Contact - SPOC). Agree on a vulnerability reporting procedure and expected response time (Service Level Agreement - SLA). Hold regular meetings to discuss current threats and the security status of delivered solutions.
If you discover a vulnerability in a vendor’s product, report it to them in a responsible disclosure manner, giving them time to prepare a fix before the information is made public. This attitude builds trust and shows that you are a mature partner. In return, expect the supplier to be transparent and proactive about the problems it identifies on its side.
Step Four: Why is safe disposal of OT equipment as important as purchasing it?
Safety management in the supply chain also includes the final stage of a product’s life - its decommissioning and disposal. Throwing an old PLC or HMI into the trash without proper preparation can lead to a serious safety incident.
These devices store extremely sensitive information in their memory: network configuration, passwords, process control logic and sometimes even production data. If they end up in the wrong hands, they can be reverse-engineered, and the resulting information can be used to prepare a precision attack on a still operational infrastructure.
Therefore, every organization must have a formal procedure for the safe disposal of OT equipment. This procedure must include the permanent, irreversible erasure of data from storage media (sanitization) or, if this is not possible, the physical destruction of the device in a way that makes it impossible to recover any information from it.
How to create a comprehensive supply chain risk management program?
An effective Supply Chain Risk Management (SCRM) program is not a collection of one-time activities, but an ongoing, institutionalized process that is an integral part of corporate governance. It must combine procedural, technical and contractual elements.
At the procedural level, a formal supply chain security policy should be created that defines criteria for evaluating and selecting suppliers, as well as procedures for the safe deployment and disposal of equipment. At the technical level, implement tools for verification and monitoring of delivered products. At the contractual level, ensure that all contracts contain appropriate security clauses.
The program must also have a clearly defined owner and management support. It should be an interdisciplinary process that involves the procurement, legal, IT, OT and security departments. Regular reviews and risk assessments of key suppliers should become part of the normal business cycle.
How can nFlo help you audit and secure your OT supply chain?
At nFlo, we understand that building a mature supply chain risk management program from scratch is an enormous challenge. It requires a unique combination of legal, technology, negotiation and in-depth industry-specific expertise. That’s why we offer comprehensive support at every stage of the process.
Our experts will help you create and implement secure purchasing policies and procedures tailored to your industry and NIS2 requirements. We can help you develop security assessment questionnaires for suppliers and support your legal department in constructing effective contractual clauses. We can also conduct an independent security audit of key partners on your behalf.
We also offer technical support in the form of secure acceptance testing services. In our lab or in your test environment, we can subject new equipment to a detailed security analysis before it is deployed in your production network. Our goal is to provide you with a complete risk picture and practical recommendations that will allow you to make informed and safe purchasing decisions.
Are you as secure as your weakest link, which is your supplier?
The old adage says that a chain is only as strong as its weakest link. In today’s interconnected world, your suppliers are an integral part of your security chain. Their weaknesses become your weaknesses, and their risks become your risks. Ignoring this fact is a strategic mistake you cannot afford to make.
The NIS2 directive and the growing number of attacks on the supply chain make it brutally clear that security does not end at our own gateway. It must extend to the entire ecosystem in which we operate. A proactive, risk-based and collaborative partnership approach to supplier security management is no longer an option - it is the foundation of digital resilience.
So ask yourself: do you really know and understand the risks associated with the technology you allow into your factory every day? Is your shiny new robot definitely an ally, or is it a Trojan horse after all? The answer to this question could determine the future of your company.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
- NIST Cybersecurity Framework — NIST Cybersecurity Framework (NIST CSF) is a set of standards and best…
- Wireless Networks — Wireless networks are communication systems that enable data transmission…
- IT Security Architecture — IT security architecture is a structural approach to designing, implementing,…
Learn More
Explore related articles in our knowledge base:
- 5G network security: What new risks and opportunities does it bring to business?
- IDS/IPS systems: Why is a firewall alone not enough to protect your network?
- Is a firewall alone enough? 5 myths about OT security
- IT vs OT: 5 key security differences every manager needs to understand
- OT Network Security: Analysis, Differences from IT, Threats and Best Practices
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
