Supply Chain Risk in IT Security
A supply chain risk in IT security arises when attackers do not attack a company directly, but instead target one of its suppliers. Through purchased software, updates, or service providers, they thereby gain access to thousands of well-protected systems simultaneously.
No company builds its computer technology entirely by itself. It buys in programs, uses third-party servers on the internet, and lets service providers handle maintenance. Each of these suppliers is given access to data or systems in the process. A supply chain risk means: it is not one’s own firm that is the weak point, but someone further back in this chain. If a supplier is attacked, the damage can strike through the normal business relationship all the way to the customer. The term originates from logistics, where a disrupted delivery can bring entire factories to a standstill — in IT, the principle works exactly the same way.
One break-in, thousands of victims
The appeal for attackers lies in the leverage effect. Attacking a large bank directly is expensive and difficult, because it maintains entire security departments. The small software manufacturer whose program the bank uses may have only twenty employees. Whoever breaks in there reaches all of that manufacturer’s customers simultaneously through a single update.
The best-known case is the attack on the company SolarWinds in 2020. Attackers smuggled malicious code into a regular update of a network software product. Around 18,000 organizations installed this update, including US government agencies and corporations. They had done everything right: they kept their software up to date. That was precisely what became their downfall.
Economically, the risk is hard to grasp because it lies outside one’s own balance sheet. A company can double its own security budget and still remain vulnerable. That is why regulators and insurers now increasingly require companies to also examine the security of their suppliers. In the EU, the NIS2 directive mandates exactly this for many industries.
Where malicious code enters the chain
The most common route is through the update. Software is continuously developed after sale and automatically downloads fixes. This channel is by definition trustworthy — otherwise it would not function. Whoever takes over a manufacturer’s update servers distributes their malicious code under that manufacturer’s good name.
A second route is ready-made code building blocks. Hardly any program is written entirely from scratch. Developers incorporate freely available libraries, i.e. prefabricated building blocks for tasks such as encryption or date calculation. An average program contains hundreds of these, often maintained by volunteers in their spare time. If an attacker takes over such a project, their code automatically migrates into thousands of applications the next time it is built.
The third route requires no malicious code at all. For practical reasons, many service providers have far-reaching access rights to their customers' systems. If their passwords are stolen, the attacker walks in through the front door. The countermeasure considered standard is the software bill of materials: a kind of ingredient list that records which third-party components are contained in a program. If a vulnerability becomes known somewhere, it can be checked within minutes whether one is affected.
From security advisory to quarterly figures
In the news, the topic usually surfaces when a name suddenly appears everywhere. That was the case in 2021 with the Log4Shell vulnerability in a widely used logging library. Hardly anyone knew the component, but it was embedded in countless server programs. For weeks, IT departments worldwide searched to find out where it was even installed within their own systems.
On the stock market, supply chain risk has long been a valuation factor. A security incident at a supplier can hit a customer’s production and revenue without the customer having made any mistake. Providers of assessment services that evaluate the security posture of business partners have become a market in their own right. Cyber insurers, too, now specifically ask about the security safeguards of service providers.
A common misconception is that the topic only concerns large corporations. In fact, small businesses are often the point of entry, because as suppliers they have access but offer little protection. One also encounters the principle in private life: a seemingly harmless browser extension can be sold on and start harvesting data in the next update. Trust in software is always also trust in everyone who helped build it.