Attack that targets organisations by compromising their suppliers, software vendors, or service providers.
A supply chain attack compromises targets indirectly by attacking their suppliers, vendors, or service providers. Rather than attacking the target directly, adversaries compromise trusted third parties—inserting malware into software updates, hardware components, or managed services that the target uses. The SolarWinds attack exemplified this, compromising thousands of organisations through a trusted software update. Supply chain attacks exploit trust relationships and can bypass even strong security when trusted software or services are weaponised.
Why It Matters
The DSC Perspective:
You're only as secure as your suppliers. Supply chain attacks have affected major organisations through trusted software. Third-party risk management, vendor assessments, and software bill of materials (SBOM) help address supply chain risk.