Supply chain attacks exploit trust relationships between organizations and their suppliers, often compromising many victims through a single point of entry.
Why it matters
- A single compromised dependency can affect thousands of organizations.
- Traditional perimeter security doesn't protect against trusted suppliers.
- Modern software relies on hundreds of third-party components.
- Supply chain attacks have caused some of the largest breaches in history.
Notable examples
- SolarWinds (2020): Malicious code inserted into software updates affected 18,000+ organizations including U.S. government agencies.
- Codecov (2021): Compromised bash uploader exposed secrets from thousands of CI/CD pipelines.
- Kaseya (2021): Ransomware delivered through MSP management software.
- Log4Shell (2021): Critical vulnerability in ubiquitous logging library.
- 3CX (2023): Desktop app compromised to deliver malware.
Attack vectors
- Software dependencies: Malicious packages in npm, PyPI, Maven.
- Build systems: Compromising CI/CD pipelines or build infrastructure.
- Code repositories: Injecting malicious commits or hijacking maintainer accounts.
- Hardware: Compromised firmware or implants in devices.
- Service providers: Attacking managed service providers (MSPs) or cloud vendors.
Defense strategies
- Software Composition Analysis (SCA): Scan dependencies for known vulnerabilities.
- SBOM (Software Bill of Materials): Inventory all components in your software.
- Vendor risk management: Assess security posture of suppliers.
- Code signing: Verify authenticity and integrity of software.
- Subresource Integrity (SRI): Verify third-party scripts haven't been modified.
- Zero trust: Don't implicitly trust any component, even from "trusted" sources.
- Monitoring: Detect anomalous behavior from trusted software.
Related Tools
Related Articles
View all articlesThreat Modeling with STRIDE and DREAD: A Complete Guide to Proactive Security Architecture
Master threat modeling with STRIDE and DREAD frameworks to identify, classify, and prioritize security threats before they become vulnerabilities. This comprehensive guide covers data flow diagrams, mitigation mappings, MITRE ATT&CK integration, and building an enterprise threat modeling program.
Read article →GitHub Actions Security: OIDC, Secrets, Permissions, and Supply Chain Protection
Secure GitHub Actions workflows with OIDC authentication, minimal permissions, pinned actions, secret protection, fork security, and supply chain hardening best practices.
Read article →
30 Cloud Security Tips for 2026: Essential Best Practices for Every Skill Level
Master cloud security with 30 actionable tips covering AWS, Azure, and GCP.
Read article →CI/CD Pipeline Security Workflow | DevSecOps Best Practices
Master the complete CI/CD pipeline security workflow from secrets management to SLSA framework implementation. Implement SAST, DAST, SCA, artifact signing, and policy enforcement to secure your software supply chain.
Read article →Explore More Threat Intelligence
View all termsAdvanced Persistent Threat (APT)
A sophisticated, long-term cyberattack where an intruder gains unauthorized access and remains undetected for an extended period to steal data or cause damage.
Read more →Credential Stuffing
An automated attack that uses stolen username/password pairs from data breaches to gain unauthorized access to user accounts on other services.
Read more →IP Reputation
A trustworthiness score (0-100) assigned to IP addresses based on observed malicious behavior, spam activity, and threat intelligence data.
Read more →Keylogger
Malicious software or hardware that secretly records keystrokes to capture passwords, credit card numbers, and other sensitive information typed by users.
Read more →Malware
Malicious software designed to damage, disrupt, or gain unauthorized access to computer systems and data.
Read more →Phishing
A social engineering attack that uses fraudulent communications to trick recipients into revealing sensitive information or installing malware.
Read more →