Supply Chain Attack
What is Supply Chain Attack?
A cyber attack that targets less secure elements in the supply chain to compromise a primary target. Supply chain attacks can involve inserting malicious code into legitimate software updates, compromising hardware during manufacturing, or exploiting third-party service providers.
Terms that appear alongside supply chain attack
Each of these is named in at least one of the same controls as supply chain attack. The number is how many controls name both.
- cybersecurity 3 shared controls
- phishing 2 shared controls
- generative ai 2 shared controls
- ransomware 2 shared controls
- prompt injection 2 shared controls
- information sharing 2 shared controls
- nist 2 shared controls
- policy 2 shared controls
Frameworks that govern supply chain attack
What the standards actually require on supply chain attack
Requirements naming supply chain attack across 6 standards, quoted from the control text.
Management identifies during risk identification the factors that raise the risk of supply chain attacks on purchased hardware and software and mitigates them by buying only from reputable sellers who control their own supply chains, purchasing through third p...
ffiec-it-examination-handbook::IS-II.C.14 · II.C.14 Supply Chain (Information Security) →For each zone and conduit, the threats that could affect it are identified from past incidents and other sources of threat information;
iec-62443::ZCR 5.1 · ZCR 5.1 Identify threats →Kuwait NCF cross-cutting Supply Chain + People. Third Party and Supply Chain Security: vendor risk management programme + onboarding due diligence + cybersecurity questionnaire (SIG + CAIQ + custom) + right-to-audit + SOC 2 Type II + ISO 27001 + ISMS-P + Kuwai...
KNCF-Supply-Chain-Third-Party-Awareness-Workforce-Capability-Vendor-Risk-Cloud-OT-IoT-Training · Kuwait NCF Supply Chain + Third Party + Awareness + Workforce + Vendor Risk + Cloud + OT/IoT →Mitigate CBRN information or capabilities risks per NIST AI 600-1 RISK-01 including: training data filtering for chemical + biological + radiological + nuclear hazardous content + model evaluation against WMDP benchmarks + safety filters at inference + uplift...
NISTAI600-6 · CBRN, Cybersecurity, and Information Security Risks (Risks 1, 9) →Provide awareness training upon initial hire, annually, and when system changes occur, focused on recognizing and responding to threats from social engineering, APT, and supply chain attacks.
3.2.1e · Provide Awareness Training on Advanced Persistent Threat →Address API9:2023 Improper Inventory Management + API10:2023 Unsafe Consumption of APIs per OWASP API Security Top 10 2023. Improper Inventory Management occurs when APIs are deployed without proper documentation + version control + decommissioning leading to...
OWASPAPI-7 · Improper Inventory Management and Unsafe API Consumption →Questions people ask about supply chain attack
What is Supply Chain Attack?
Why is Supply Chain Attack important for compliance?
Which compliance frameworks address Supply Chain Attack?
Where can I learn more about Supply Chain Attack?
See how Supply Chain Attack applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.