跳转到内容
开始
Open search

Solutions

Company: Banner with Media - Background

Securing Your Supply Chain

Contact Us
Download Whitepaper
Securing Your Supply Chain

Organizations often rely on third-party suppliers to manage business functions such as IT infrastructure. Enabling third-party suppliers to connect to your network introduces vulnerability to supply chain attacks. Adversaries infiltrate third-party suppliers and exploit their trusted access to gain access to your environment. Once they get in, they conduct all sorts of malicious activities from data theft and extortion to ransomware. Sophos offers a combination of security technologies and services to help mitigate the risks from such supply chain attacks.

Types of supply chain attacks

Several high-profile data breach events highlight that supply chain remains a major weak link in the cybersecurity chain of organizations.

In late 2020, it was discovered that the supply chain of IT management firm SolarWinds was compromised and adversaries were able to insert malicious code into SolarWinds’ infrastructure monitoring and management platform, Orion. This code was unwittingly sent out to almost 18,000 customers. Read Sophos’ in-depth analysis of how the Sunburst malware variant evaded defenses here.

Let’s look at the common strategies deployed in some of the most significant supply chain attacks:

Phishing attacks icon

Phishing Attacks

Phishing emails are the most commonly used attack vector in supply chain attacks. Attackers target trusted third parties with phishing emails to compromise and gain access to their networks, and then use them as a springboard to infiltrate their clients’ systems.
Compromised software update icon

Compromised Software Update

In more sophisticated attacks, hackers infiltrate the infrastructure of a software company or distributor and insert malicious code into software update packages. The third party then distributes these updates to their clients, unknowingly infecting them in the process.
Poison packages icon

Poison Packages

As use of the cloud, Docker, and agile development methodologies grows, so does the use of off-the-shelf components to shorten the development lifecycle. Malicious actors have begun to booby trap some commonly used containers, libraries, and other resources, hoping to get bundled into your end product.