Supply chain attack: meaning

In short

Instead of attacking a hundred well-protected companies directly, the attacker compromises just one, the supplier, which all hundred trust. Access comes through a channel considered safe: a signed update, an authorised remote connection, a legitimate mailbox. That is why it is hard to detect and can have large-scale effects.

How it works

The most common routes:

• compromised software: malicious code inserted into a product's updates, as in the case of the SolarWinds Orion platform discovered at the end of 2020;
• managed service providers: an attack on an IT provider's remote management tools spreads to all its customers, as happened with Kaseya VSA in July 2021, used to distribute ransomware;
• open source components and libraries built into products, which bring their own vulnerabilities with them;
• supplier credentials and access: the external technician with an always-on VPN, or the supplier's compromised mailbox used to send convincing phishing.

Why it matters

A company's security does not end at its perimeter. The NIS2 Directive includes supply chain security among the mandatory measures, and ISO/IEC 27001 devotes a group of controls to supplier relationships. The practical defences:

• knowing which suppliers have access to which systems and data, and how critical they are;
• qualifying them with questionnaires and requests for evidence, and including security obligations in contracts;
• giving suppliers access with minimum privileges, MFA and logging, enabled only when needed;
• following security news about the products and suppliers you depend on, with threat intelligence.

Example

A local software house manages the business management software of thirty customers through a remote access tool. An attacker steals a technician's password, which has no second factor, and gets into the tool. From there they reach the servers of every customer in a single night. The customers that had limited remote access to agreed times, with case-by-case approval and logs of external system administrators' logins, notice immediately or are not reached at all; the others find out the next morning.

Related terms

• Threat intelligence
• System administrator
• Attack Surface Management
• Ransomware