Definition
Supply chain attack
In one sentence
A supply chain attack is a cyberattack that compromises a trusted third party, such as a software vendor, IT provider or supplier, in order to reach that party's customers.
Critical Cyber Systems Protection ActSOC 2Privileged access management
Supply Chain Attack Explained
Supply chain attacks exploit trust. Instead of breaking into each target separately, the attacker compromises one provider whose software, updates or remote access already reach many organizations. International examples include the SolarWinds Orion compromise in 2020, the Kaseya VSA ransomware attack in 2021, which spread through managed service providers, and the MOVEit Transfer data theft campaign in 2023.
For small businesses, the most realistic supply chain risks are closer to home: an IT provider's remote management tool abused to deploy ransomware, a vendor's email account used to send fraudulent invoices, or a widely used SaaS application with a vulnerability.
Managing supply chain risk does not require a large program. Know which suppliers have privileged access or hold sensitive data. Ask key vendors about MFA, monitoring and certifications such as SOC 2 or ISO 27001. Limit and review third-party access. Monitor activity from remote management tools. And verify payment changes by phone.
Canada's Critical Cyber Systems Protection Act requires designated operators to manage supply chain risk, which will push expectations down to their suppliers.
General information for Canadian organizations, not legal advice.