Supply Chain Attack
What is Supply Chain Attack?
A cyber attack that targets less secure elements in the supply chain to compromise a primary target. Supply chain attacks can involve inserting malicious code into legitimate software updates, compromising hardware during manufacturing, or exploiting third-party service providers.
Terms that appear alongside supply chain attack
Each of these is named in at least one of the same controls as supply chain attack. The number is how many controls name both.
- cybersecurity 3 shared controls
- phishing 2 shared controls
- generative ai 2 shared controls
- ransomware 2 shared controls
- prompt injection 2 shared controls
- information sharing 2 shared controls
- nist 2 shared controls
- policy 2 shared controls
Frameworks that govern supply chain attack
What the standards actually require on supply chain attack
Requirements naming supply chain attack across 6 standards, quoted from the control text.
Vulnerability Management is a core technical control area per FSA Cybersecurity Guidelines. (1) Vulnerability Discovery: (a) Authenticated and Unauthenticated Scanning - Nessus + Qualys + Rapid7 + open source; (b) DAST Dynamic Application Security Testing;
JP-FSA-CYB-Vulnerability-Management-Patching-CVE-Risk-Based-Prioritisation-Penetration-Testing-Red-Team · Japan FSA Cybersecurity Vulnerability Management + Patching + CVE Tracking + Risk-Based Prioritisation + Penetration Testing + Red-Team + Bug Bounty + Coordinated Vulnerability Disclosure + Zero-Day Response →HKMA C-RAF 2024-2025 pipeline + emerging risks + sectoral cybersecurity evolution. KEY 2024-2025 INITIATIVES: (1) AI + MACHINE LEARNING + GENERATIVE AI CYBER GOVERNANCE - AIs deploying AI/ML for fraud detection + AML + customer service + lending + risk managem...
HKMA-CRAF-2024-2025-AI-Quantum-Cloud-Ransomware-DORA · HKMA C-RAF 2024-2025 Pipeline - AI, Quantum-Resistant Cryptography, Cloud Security, Ransomware, EU DORA Coordination →Kuwait NCF cross-cutting Supply Chain + People. Third Party and Supply Chain Security: vendor risk management programme + onboarding due diligence + cybersecurity questionnaire (SIG + CAIQ + custom) + right-to-audit + SOC 2 Type II + ISO 27001 + ISMS-P + Kuwai...
KNCF-Supply-Chain-Third-Party-Awareness-Workforce-Capability-Vendor-Risk-Cloud-OT-IoT-Training · Kuwait NCF Supply Chain + Third Party + Awareness + Workforce + Vendor Risk + Cloud + OT/IoT →Mitigate CBRN information or capabilities risks per NIST AI 600-1 RISK-01 including: training data filtering for chemical + biological + radiological + nuclear hazardous content + model evaluation against WMDP benchmarks + safety filters at inference + uplift...
NISTAI600-6 · CBRN, Cybersecurity, and Information Security Risks (Risks 1, 9) →Provide awareness training upon initial hire, annually, and when system changes occur, focused on recognizing and responding to threats from social engineering, APT, and supply chain attacks.
3.2.1e · Provide Awareness Training on Advanced Persistent Threat →Address API9:2023 Improper Inventory Management + API10:2023 Unsafe Consumption of APIs per OWASP API Security Top 10 2023. Improper Inventory Management occurs when APIs are deployed without proper documentation + version control + decommissioning leading to...
OWASPAPI-7 · Improper Inventory Management and Unsafe API Consumption →Questions people ask about supply chain attack
What is Supply Chain Attack?
Why is Supply Chain Attack important for compliance?
Which compliance frameworks address Supply Chain Attack?
Where can I learn more about Supply Chain Attack?
See how Supply Chain Attack applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.