Supply Chain Security Basics
Supply-chain attacks compromise you not by breaking through your defenses, but through the software and vendors you already trust. A poisoned dependency, a tampered vendor update, a compromised build tool — the malicious code arrives inside something legitimate you install willingly. Several of the most damaging breaches of recent years took this path, because trust is exactly what it exploits.
How do supply-chain attacks work?#
The attacker compromises a link upstream of the target:
| Vector | Example |
|---|---|
| Dependency | A popular open-source package altered to add a backdoor |
| Vendor update | A trusted software update carrying malicious code |
| Build system | A compromised CI/CD pipeline injecting into builds |
| Package registry | Typosquatted or hijacked packages |
Because the code is delivered through a channel you trust and often auto-update, it sidesteps the defenses aimed at outside attackers — and one compromise can reach every downstream victim at once.
What reduces the risk?#
No single control eliminates supply-chain risk, but several together shrink it:
- Know what you run — a software bill of materials and SCA.
- Verify integrity — pin versions, check signatures, use trusted sources.
- Least privilege for build systems and third-party integrations.
- Monitor for anomalous behavior from trusted software.
Supply-chain security addresses the risk in software you did not write. More at the Defense & Hardening hub.
Frequently asked questions#
What is a software supply-chain attack?
A supply-chain attack compromises an organization indirectly, through a trusted third party in its software supply chain — a dependency, a vendor’s update, a build tool, or a compromised package. Because the malicious code arrives inside software you already trust and install, it bypasses defenses aimed at external attackers.
Why are supply-chain attacks so effective?
Because they exploit trust and scale. Software is assembled from many components you did not write and update automatically, so a single compromised dependency or vendor update can reach thousands of victims at once. The malicious code is delivered through legitimate, trusted channels, which is exactly what makes it hard to catch.