Supply Chain Attacks

What it is

A supply chain attack compromises a business indirectly, by breaching one of its trusted suppliers, software vendors or service providers. Instead of attacking you head-on, the attacker targets a weaker link you rely on, then uses that trusted connection or software update to reach you and many other customers at once.

How it works

1. 1

   The attacker identifies a supplier, managed provider or software vendor that many businesses trust.

2. 2

   They compromise that provider, for example by poisoning a software update or stealing access credentials.

3. 3

   Malicious code or access is distributed to the provider’s customers through normal, trusted channels.

4. 4

   Because the source is trusted, the intrusion often goes undetected.

5. 5

   The attacker uses the access to steal data or deploy further attacks such as ransomware.

Business impact

• Compromise that arrives through trusted, hard-to-detect channels
• Data breaches originating from a third party you rely on
• Widespread impact when a shared provider is hit
• Complex incident response spanning multiple organisations

How to defend against it