Supply Chain and MSP Compromise

Layer 7: Application High risk

How it works

Every organization relies on outside parties: software vendors, cloud services, accounting platforms and IT service providers. These relationships involve trust, such as automatic software updates or remote management tools with administrator rights. If an attacker compromises the supplier, they can sometimes use that trusted path to reach the supplier's customers. The more privileged and widespread the supplier's access, the greater the potential impact of a breach on your organization.

A tampered software update, a breached remote management platform or stolen provider credentials can affect many businesses at once. Smaller suppliers may have less security maturity than their clients, making them an attractive back door. Because the access is expected, defenders may not notice unusual activity until damage is done. Choosing and holding suppliers to clear security standards is part of managing this risk.

Warning signs

• Vendor announcements or advisories about a breach
• Remote management sessions you did not expect
• Software updates behaving unusually after installation
• Vendor accounts active outside agreed hours
• Suppliers unable to describe their own security controls

How to defend against it

• Assess suppliers' security before granting access
• Give vendors only the access they need, with MFA and logging
• Require your IT provider to protect its own tools with strong controls
• Monitor third-party remote access sessions
• Include breach notification terms in contracts
• Keep independent backups the supplier cannot alter

If it happens to you

1. Disable the affected vendor access or integration
2. Follow the supplier's guidance and indicators of compromise
3. Review systems the supplier could reach for changes
4. Engage incident response and assess notification duties