thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Supply Chain Attack

An attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.

Definition

Supply chain attacks target build systems, software updates, open-source packages, managed service providers or hardware. A single compromise can affect thousands of organizations that trust the supplier. Mitigations include vendor risk management, SBOMs, code signing verification and least-privilege third-party access.

Example

The SolarWinds Orion update containing the SUNBURST backdoor reached about 18,000 customers.

Exam tip

SolarWinds, Kaseya and 3CX are standard supply chain examples; SBOM is a key mitigation answer.

Related terms