Supply chain attack
software supply chain attack · third-party compromise · vendor compromise · island hopping · attaque de la chaîne d’approvisionnement
An attack that compromises a trusted supplier, service provider or software component in order to reach all of its customers in turn.
In practice
Rather than attack a thousand companies, the attacker compromises one: a software vendor, a managed service provider, an open-source library. The legitimate update or access then becomes the Trojan horse. These attacks are formidable because they exploit the trust placed in partners. The NIS2 directive (still being transposed into French law) and the EU Cyber Resilience Act make supplier and component security an explicit requirement.
In December 2020, updates to the SolarWinds Orion monitoring software were found to contain a backdoor inserted during the build process. CISA ordered US federal agencies to disconnect the affected servers immediately; the United States attributed the attack to Russia’s foreign intelligence service (SVR).
How to protect yourself
- Inventory your critical suppliers and their access, and cut that access to the strict minimum.
- Ask for an SBOM and track vulnerabilities in your dependencies (software composition analysis).
- Check the integrity of updates and packages: signatures, official sources, pinned versions.
- Include security and incident notification clauses in your contracts.
