What characterizes a supply chain attack?

• A. It targets secure elements within a supply chain
• B. It exploits less secure elements to compromise a larger target
• C. It focuses solely on software vulnerabilities
• D. It involves physical sabotage of shipping containers

Answer: (B)

A supply chain attack is characterized by exploiting less secure elements to compromise a larger target. This approach takes advantage of the fact that in a supply chain, various components or services might have different levels of security. Attackers aim for weaker links within the supply chain, such as third-party vendors or suppliers, which may not have robust security measures in place. By breaching these less secure elements, attackers can then gain access to the larger target, facilitating the potential for data breaches, malware distribution, or system compromises without directly attacking the more secure elements.

This strategy underscores the importance of comprehensive security throughout the entire supply chain and not just the primary organization. The interconnected nature of businesses means that vulnerabilities in one area can have significant repercussions for larger systems.

The other choices do not fully capture the essence of a supply chain attack. Some focus on specific aspects that are not universally applicable, such as restricting the scope to software vulnerabilities or physical sabotage of shipping containers. These do not encompass the broader strategy of targeting multiple elements within the supply chain to achieve an end goal.