Why Supply-Chain Attacks Put Connected Organizations at Risk
Summary
An overview of how compromised suppliers and integrations can expose connected organizations, with recommendations for visibility, verification, vendor accountability, least privilege, and limiting the impact of compromise.
Key points
- Compromising a trusted supplier, service, or integration can provide attackers with access to multiple connected organizations.
- The article cites a Cowbell Cyber estimate of a 431% increase in supply-chain attacks from 2021 to 2023 and Verizon’s finding that 15% of breaches involved a third party.
- Risks span software updates and dependencies, hardware and firmware, cloud and SaaS integrations, and MSP tools.
- The article highlights the Kaseya VSA incident, in which a malicious update reportedly spread ransomware to 1,500 organizations.
- Recommended measures include mapping vendors and privileges, checking software integrity with SBOMs and signature validation, and setting clear vendor security expectations.
- It also recommends least privilege, network segmentation, continuous monitoring, and verifying updates to reduce the potential impact of a supplier compromise.
Article Details
- Topic
- Supply chain attacks and zero-trust strategies for securing software, hardware, cloud, and managed-service ecosystems
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsThe article describes malicious packages and compromised dependencies in open-source ecosystems, including NPM.T1195.002 · Compromise Software Supply ChainAttackers compromised software build pipelines and inserted malicious code into signed updates, including in the SolarWinds intrusion.
People
Threat Actors
ICE RELICNamed as a nation-state group that exploits supply weaknesses to establish covert access to high-value networks.LazarusNamed as a nation-state group that exploits supply weaknesses to establish covert access to high-value networks.UNC2452Named as a nation-state group that exploits supply weaknesses to establish covert access to high-value networks.
Malware
Vendors
ConnectWiseMSP and IT Vendor Compromise: Events involving Kaseya and exploitation attempts against ConnectWise demonstrated how attackers can abuse remote management platforms to move laterally into customer ecosystems.KaseyaMSP and IT Vendor Compromise: Events involving Kaseya and exploitation attempts against ConnectWise demonstrated how attackers can abuse remote management platforms to move laterally into customer ecosystems.OktaCloud and SaaS Exposure: Breaches affecting Okta, issues tied to GitHub Actions, and the trojanized 3CX component demonstrate how attackers can exploit APIs, compromise integrations, and misuse credentials.SolarWindsSoftware Supply Chain Breaches: SolarWinds, Log4j, and Codecov all revealed how compromised updates, vulnerable libraries, or corrupted build tools can instantly infect thousands of connected organizations.SupermicroHardware Supply Chain Vulnerabilities: Supermicro vulnerabilities and firmware-level exploits show how weaknesses can be introduced into devices before they even reach an organization.
Products
3CXCloud and SaaS Exposure: Breaches affecting Okta, issues tied to GitHub Actions, and the trojanized 3CX component demonstrate how attackers can exploit APIs, compromise integrations, and misuse credentials.GitHub ActionsCloud and SaaS Exposure: Breaches affecting Okta, issues tied to GitHub Actions, and the trojanized 3CX component demonstrate how attackers can exploit APIs, compromise integrations, and misuse credentials.Kaseya VSAThe 2021 Kaseya VSA incident, where a malicious update was delivered through a legitimate mechanism, spread ransomware to 1,500 organizations worldwide.SolarWinds OrionSupply Chain Exploitation of SolarWinds Orion Software
Industries
IndustrialFor organizations in the manufacturing and industrial sectors, where hardware integrity supports production systems, safety controls, and automation, the risks are particularly acute.ManufacturingFor organizations in the manufacturing and industrial sectors, where hardware integrity supports production systems, safety controls, and automation, the risks are particularly acute.