Supply Chain Attack

Supply chain attacks can happen at any point in a system's lifecycle. They are used to exfiltrate or manipulate data, to disrupt or manipulate system operations, or to give the adversary the ability to access, disrupt, or manipulate a system in the future. The supply network can be internal to the targeted organization, such as logistics services, or external, such as third-party product and service providers.

Risk can come from a supplier in several ways. A supplier may fail to secure its systems adequately, may have a malicious insider, or its staff may mishandle the customer's information. A supplier may also deliberately seek to undermine the customer's systems, in some cases under state influence for national security applications.

In software, a single application may rely on a large number of third-party packages, many of them retrieved automatically through continuous integration and continuous delivery (CI/CD) pipelines, often without human intervention. NCSC warns that this combination of automation, trust, and scale lets malicious code introduced into a single package spread rapidly across many organizations and services before detection. Methods seen in recent attacks include stealing credentials or tokens that allow updates to a trusted package, taking over abandoned packages, and typosquatting popular package names.

Defense starts with knowing who the suppliers are, what physical and logical access they have to systems, premises, and information, and what security risk the supply chain poses. For software dependencies, NCSC recommends a clear inventory of all dependencies, such as a software bill of materials (SBOM), manual review of new updates, dependencies, and versions, multi-factor authentication for developer and package registry accounts, rotation of exposed credentials, and private or trusted registries where appropriate.