Supply chain attack

A supply-chain attack targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed. Because every item sold undergoes a process that involves third parties, this means that the security breach can occur at any point in the supply chain. These attacks are costly because they can affect multiple organizations and the individuals who work for them. Supply-chain attacks can fall under several domains, including but not limited to the security and risk management, security architecture and engineering, and security operations domains.

Common Patterns#

• Using unverified or unmaintained libraries and dependencies
• Automatically installing updates without verification
• Over-reliance on third-party AI models without monitoring or auditing
• Insecure build pipelines or CI/CD processes that allow tampering
• Poor license or provenance tracking for components
• Lack of monitoring for vulnerabilities in dependencies after deployment

How To Protect The Supply Chain#

• Verify all third-party components, libraries, and AI models before use
• Monitor and patch dependencies regularly
• Sign, verify, and audit software updates and packages
• Lock down CI/CD pipelines and build processes to prevent tampering
• Track provenance and licensing for all dependencies
• Implement runtime monitoring for unusual behaviour from dependencies or AI components
• Integrate supply chain threat modelling into the SDLC, including testing, deployment, and update workflows