Category hub: Vulnerabilities and exploitation

In one sentence: A supply chain attack is when criminals get at you by compromising a supplier or a product you rely on, instead of attacking you directly.

What is a supply chain attack?

The NCSC defines a supply chain as the extended network of trading relationships relied on to deliver products, systems and services. It says supply chains are often large and complex, which makes it hard to know whether enough protection is in place, and that attacks resulting from supply chain weaknesses have increased significantly.

Your suppliers can include software vendors, an MSP, a payroll provider, a parts maker or an open-source library your developers use. A weakness at any of them can become your problem.

How it works

1. The attacker picks a supplier that is easier to attack than the final target.
2. They compromise it. That might be a stolen password, an infected software update, or a tampered open-source package. The NCSC notes attackers are compromising open-source packages to spread malware.
3. The harm travels down the chain, through remote access the supplier has, software you install, or a service you depend on.
4. The attacker steals data, disrupts operations or demands payment.

Who it affects and how badly

• Sole trader to 10 staff: you rely on a few big suppliers such as email, accounting software and an IT provider. If one is hit, you may lose access or see fraud from stolen data.
• 10 to 250 staff (manufacturing, construction, MSP clients, retail): a supplier outage can stop orders or production. An MSP can be a route to many clients at once.
• 250 plus and regulated firms (councils, fintech, insurance, healthcare): ask suppliers that handle your data how they protect it. The NCSC says good supplier controls help demonstrate compliance with data protection law and may help win contracts.

Real examples

• Toyota and Kojima Industries (2022). Toyota said that because of a system failure at a domestic supplier, Kojima Industries, it suspended all 28 lines at 14 plants in Japan for a day and resumed from the next shift: Toyota newsroom. Toyota called it a system failure. A Reuters report said a Kojima spokesperson stated it appeared to have been hit by some kind of cyber attack: Reuters via Nippon.com.

How to detect it

• Keep a list of suppliers with access to your systems or data, and what that access is.
• Review sign-ins and remote-access logs for supplier accounts, and alert on unusual times and places.
• Subscribe to security notices from your key vendors and check them when they arrive.

How to fix or prevent it

1. Know your suppliers and which ones matter most. The NCSC’s first principles are about understanding the risks.
2. Put minimum security requirements in contracts and ask suppliers to pass them to sub-contractors, as the NCSC suggests.
3. Ask suppliers about Cyber Essentials. The NCSC says certification gives a tangible way to gain assurance that suppliers have fundamental technical controls in place.
4. Give suppliers only the access they need, protected by multi-factor authentication, and remove it when the work ends.
5. Have a plan for a supplier outage.
6. Review open-source dependencies, as the NCSC asks cyber defenders to do.

Related terms

• third-party-software-compromise
• third-party-risk-management
• dependency-confusion
• cyber-essentials
• patch-management
• secret-rotation

Also read: access-bypass.

Frequently asked questions

What is a supply chain attack?
It is when criminals get at you by compromising a supplier or a product you rely on, instead of attacking you directly.

What can a supply chain include?
Software vendors, an MSP, a payroll provider, a parts maker or an open-source library your developers use.

What can I do about supplier risk?
Know your suppliers, put minimum security requirements in contracts, ask about Cyber Essentials and give suppliers only the access they need, protected by multi-factor authentication.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.

Service page: Wolfcore penetration testing.