Glossary
Supply Chain Attack
A supply chain attack is like poisoning the water supply instead of breaking into individual houses. Attackers compromise a software company or vendor that many businesses trust, then use that access to attack everyone who uses that vendor's products. One successful attack can hit thousands of victims.
What is Supply Chain Attack?
A supply chain attack targets a less-secure element in a company's supply chain - typically a software vendor, service provider, or hardware manufacturer. By compromising a trusted supplier, attackers can gain access to all of that supplier's customers. These are among the most sophisticated and damaging attacks.
Why Should You Care?
Supply chain attacks exploit the trust businesses place in their vendors. When you install software from a trusted vendor, you expect it to be safe. Supply chain attacks abuse that trust. The SolarWinds attack compromised 18,000+ organizations through a single software vendor - including major government agencies.
Is your business exposed?
Real-World Example
The SolarWinds attack in 2020 remains the most notorious supply chain attack. Russian hackers compromised SolarWinds' software build process, inserting malware into legitimate updates. When 18,000 customers installed these 'trusted' updates, they unknowingly installed a backdoor. Victims included the US Treasury, Microsoft, and many Fortune 500 companies.
How to Protect Against Supply Chain Attack
- 1.
Inventory all software vendors and their access to your systems
- 2.
Require security questionnaires from critical vendors
- 3.
Minimize vendor access to only what's necessary
- 4.
Monitor for unusual activity from vendor connections
- 5.
Have an incident response plan that includes vendor compromise scenarios
- 6.
Consider software bill of materials (SBOM) for critical applications
Related Terms
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required