In short
A supply chain attack compromises a trusted supplier's software, hardware or services, for example by inserting malicious code into a software update, to reach the supplier's customers.
Key takeaways
- Customers install the malicious code themselves because they trust the source.
- Defenses include vendor risk management, verifying software signatures and limiting vendor tools' privileges.
- A list of the components in each software product helps find exposure quickly.
Where it's tested
ISC: Third-Party & Vendor Risk — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A service organization's SOC 1 report uses the carve-out method for a subservice organization. What does this mean for the user entity?