Supply Chain Attacks: When Trusted Software Turns Against You
Instead of attacking a well-defended target directly, attackers increasingly go after something the target trusts: a software vendor, an update server, an open-source component, or a managed service provider. Compromise one supplier and you can reach all of its customers at once. This is a supply chain attack.
These attacks are dangerous precisely because they arrive through channels we are told to trust, like a signed software update. This guide explains the main types and the practical defenses.
How supply chain attacks work
The attacker compromises a link in the chain that many organizations rely on, then rides that trust downstream. Because the malicious code comes from a legitimate vendor, it often carries valid signatures and sails past defenses.
The victims did nothing careless; they simply installed an update or used a component they had every reason to trust.
Common forms
Supply chain attacks take several shapes:
- Software updates: attackers plant malicious code in a vendor update, which then auto-installs on every customer.
- Open-source dependencies: a popular code library is hijacked, or a malicious package is published with a look-alike name.
- Hardware or firmware: tampering during manufacturing or shipping.
- Service providers: a breached IT or managed-service provider is used to reach its clients.
What actually reduces the risk
You cannot audit every vendor, but you can limit how much damage a compromised one can do.
The theme is the same as zero trust: assume any single component could be compromised, and contain the blast radius.
- Keep an inventory of your software and its components, known as a software bill of materials.
- Apply least privilege so a compromised tool cannot reach everything.
- Segment networks and monitor for unusual behavior, even from trusted software.
- Vet critical vendors and have a plan for when one is breached.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
The trusted update that opened thousands of doors
In a widely reported incident, attackers quietly inserted malicious code into a legitimate update for widely used network-management software. The update was digitally signed and shipped through the normal channel.
Around 18,000 organizations installed it, trusting it as a routine patch. The attackers then chose a smaller number of high-value victims to burrow into. No customer had been careless; they had simply updated their software.
- Trust is the attack surface. The malicious code worked because it came from a trusted vendor through a signed update. It is from our vendor is not the same as it is safe.
- Contain what you cannot prevent. You cannot personally verify a vendor build system, but segmentation and least privilege limit how far a poisoned update can spread inside you.
- Watch trusted software too. Monitoring for unusual behavior, even from approved tools, is what catches a supply chain attack after it slips in.
Test yourself
Test your third-party risk knowledge, free.
Frequently asked questions
If updates can be attacked, should I stop updating?
No. Skipping updates exposes you to far more attacks than it prevents; the vast majority of updates are safe and close real holes. Keep updating, and reduce supply chain risk with segmentation and least privilege instead.
What is a software bill of materials (SBOM)?
An SBOM is an inventory of all the components and libraries inside a piece of software. It lets you quickly answer whether you are affected when a component is found to be vulnerable or compromised.
How can a small business defend against supply chain attacks?
Focus on basics that limit damage: keep an inventory of the software you use, give tools only the access they need, enable MFA, keep backups, and pay attention to security notices from your key vendors.