Security News > 2021 > July > Where does the SME fit into a supply chain attack?
Businesses have connections to other businesses, who supply them with goods, and whom they supply with goods - both parts and software.
In many cases, a company has its own supply chain while simultaneously being part of the supply chain for other, probably larger, businesses.
Every company has a duty to protect its customers from supply chain attacks while simultaneously taking action to prevent being a supply chain victim of its own suppliers.
The classic example of the possible scale of a software supply chain attack can be found in the 2020 SolarWinds hack in the U.S. Following an undetected breach at SolarWinds, attackers were able to surreptitiously add malware to its Orion software.
SMEs - like MEDoc and Inbenta - are frequently the target of supply chain attacks.
With supply chain attacks being a major growth area for cyber criminals, this is a worsening scenario, and the question is "What can the SME do to protect both itself and its customers?".
News URL
http://feedproxy.google.com/~r/HelpNetSecurity/~3/y2ayZRncoJQ/
Related news
- GitHub supply chain attack spills secrets from 23,000 projects (source)
- Supply chain attack on popular GitHub Action exposes CI/CD secrets (source)
- Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos (source)
- GitHub Action hack likely led to another in cascading supply chain attack (source)
- GitHub Action supply chain attack exposed secrets in 218 repos (source)
- Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed (source)
- ⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More (source)
- Recent GitHub supply chain attack traced to leaked SpotBugs token (source)
- SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack (source)
- That massive GitHub supply chain attack? It all started with a stolen SpotBugs token (source)