🎁 New User? Get 20% off your first purchase with code NEWUSER20 · ⚡ Instant download · 🔒 Secure checkout Register Now →
Menu

Categories

Security Intermediate

What is Supply Chain Attack?

A cyberattack that targets less-secure elements in the software supply chain to compromise downstream users and organizations.

Supply chain attacks compromise software before it reaches end users by targeting dependencies, build systems, or distribution channels. Examples include typosquatting (malicious packages with similar names on PyPI/npm), compromised maintainer accounts, backdoored updates (SolarWinds attack), and poisoned CI/CD pipelines. Defense measures include pinning dependency versions, using lock files, verifying package signatures, scanning dependencies for known vulnerabilities (npm audit, pip-audit, Snyk), using private package registries, implementing Software Bill of Materials (SBOM), and practicing least-privilege in build systems. The Log4Shell vulnerability demonstrated how a single dependency can impact millions of applications.

Related Terms

OWASP Top 10
A regularly updated list of the ten most critical web application security risks, published by the Open Web Application Security Project.
Security Hardening
The process of reducing a system's attack surface by disabling unnecessary services, applying patches, and configuring security controls.
Security Headers
HTTP response headers that instruct browsers to enable security features like XSS protection, framing prevention, and content type enforcement.
API Security
Practices and mechanisms for protecting APIs from unauthorized access, data breaches, and abuse.
JWT (JSON Web Token)
A compact, self-contained token format used for securely transmitting information between parties as a JSON object.
Certificate Pinning
A security technique that associates a host with its expected TLS certificate or public key, preventing man-in-the-middle attacks with fraudulent certificates.
 View All Security Terms →