Definition
A supply chain attack targets an organization by compromising a less secure element within its network of suppliers or vendors. Instead of directly attacking the primary target, attackers infiltrate a trusted third party, such as a software provider or hardware manufacturer, to gain access. This method leverages the inherent trust relationships between organizations to bypass traditional security measures. For instance, attackers might inject malicious code into a software update distributed to many customers. This differs from a direct attack, which targets the organization's own systems. Understanding supply chain attacks is crucial for cybersecurity professionals and appears on exams like Security+ and CISSP.