What is a Supply chain attack?
Compromising a vendor, plugin or update that many businesses trust, to reach them all at once.
Instead of attacking you, the criminal attacks something you install: a WordPress plugin, an accounting integration, a managed service provider. One poisoned update reaches thousands of businesses.
The defence is knowing what you run and hearing quickly when one of those things is compromised.
What to do
- Keep the list of plugins and tools short.
- Declare your software in the app; vulnerability alerts cover it.
- Vendor status and breach alerts cover the services you depend on.