Supply Chain Attack

Infiltrating third-party software dependencies or vendor hardware to compromise downstream targets.

Core Principles & Analysis

• The 2020 SolarWinds compromise reached roughly 18,000 organizations.
• Abuses the trust placed in signed vendor software updates.
• Mitigated with software bills of materials and dependency pinning.