Adversaries may gather information about a victim's business relationships. MITRE lists this under Reconnaissance with platform PRE. Those relationships include second and third party organizations and domains, such as managed service providers and contractors, that have connected and potentially elevated network access.
MITRE adds that the information may also reveal supply chains and shipment paths for the victim's hardware and software.
How attackers use it
The data may come from direct elicitation, such as phishing for information, or from accessible data sets such as social media and the victim's own websites. A customer page, a case study, or a partner logo can be enough.
MITRE links the results to more reconnaissance, to creating or compromising accounts, and to initial access through supply chain compromise, drive-by compromise, or a trusted relationship.
The reasoning is simple. If a provider has access to you and is easier to attack, the provider becomes the route.
Supplier relationships are also a map of dependencies. A public page that lists a software vendor, a cloud provider, or a managed service tells an attacker where a trusted path may exist. That path can be easier to attack than your own network.
MITRE's mention of shipment paths matters for hardware and software supply chains. Knowing when and how products reach you can help an attacker choose a moment to tamper or to impersonate.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
Where you can see something is on the trusted paths: sign-ins from provider accounts, new remote access tools, and software updates from vendors that arrive outside the usual process.
Inventory is the base. If you know every vendor with access and every package you depend on, you can see a new or unexpected one.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Maintain a register of providers, contractors, and key software suppliers, with what each can reach.
- Keep third party access narrow and strongly authenticated, and remove it when it ends.
- Check what you publish about customers and partners, and agree it with them.
- Verify software and updates from suppliers, and keep an inventory of the dependencies in what you build or run.
- Ask suppliers about their own security practices as part of onboarding.
The demo below walks through reviewing a vendor. Use it as a template for your own questions: what access does it have, what data does it hold, and how would you know if something went wrong?
Check your own environment
- Do we have a current list of every provider with access to our systems?
- When did we last review what each can reach?
- Do public customer and partner pages reveal tooling or access arrangements?
- Do we know which software suppliers and packages sit inside our products?
Try it yourself
A walkthrough of reviewing a vendor, from inventory through risk, with the defensive questions to ask.
Click through it at your own pace, or open it full screen.
Quick check
Why do business relationships matter to attackers?
Connected providers may have elevated access and be easier to attack, and the relationships can reveal supply chains and shipment paths.
Which initial access techniques does MITRE connect to it?
Supply chain compromise, drive-by compromise, and trusted relationship.
Sources
- MITRE ATT&CK, Business Relationships (T1591.002): https://attack.mitre.org/techniques/T1591/002
