Supply-chain attacks compromise trusted vendors or dependencies, potentially reaching downstream systems; verify provenance and limit access before deployment.
Search across headline titles and summaries.
Background for this topic.
Supply chain is the network of suppliers, software developers, service providers, components, and processes used to build and deliver an organization’s products or services. In a security threat model, it extends the trust boundary beyond the organization: a compromised supplier account, build system, software dependency, update mechanism, or hardware component can introduce malicious code, expose credentials, or undermine systems used by many customers.
Effective protection starts with mapping critical suppliers, dependencies, data flows, and access, then applying risk-based due diligence and least-privilege, segmented access. For software, maintain an inventory such as a software bill of materials, verify signed artifacts and update provenance where feasible, and monitor dependencies for vulnerabilities or unexpected changes. Contracts and technical controls should support timely notification and investigation. Response plans should cover revoking supplier access, isolating affected versions or integrations, determining exposure, and coordinating remediation with the provider.
A malicious package uploaded to the npm registry has been found deploying a sophisticated remote access trojan on compromised Windows machines
Continuous integration and continuous delivery (CI/CD) misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks
As zero days and complex networks create gaps for cyberattacks, software developers and agencies such as CISA look to secure by design for building in defenses.
Pentagon Warns Failure to Modernize Defense Industrial Base Will Hinder US GloballyThe Department of Defense released a 60-page strategy that aims to modernize the defense industrial ecosystem and focuses on four long-term strategic priorities: improving supply chain resilience, enhancing workforce readiness, streamlining acquisitions and refining economic deterrence measures.
Security teams need to start including AI tools and machine learning models when thinking about the software supply chain: They can't protect what they don't know they have.