Supply Chain Vulnerabilities Quiz

✅ Correct: B. Supply chain attacks succeed because they exploit trust rather than breaking security controls. A vendor with legitimate VPN access using stolen legitimate credentials looks exactly like normal authorized activity. The intrusion detection system sees "authorized vendor account accessed permitted systems during business hours" — not an attack signature. The attacker bypasses the security perimeter entirely by entering through a door that was already open for business reasons. This is why vendor credential compromise is so dangerous: the access control system is doing its job correctly — it's the underlying trust model that has been exploited.

✅ Correct: B. Fazio Mechanical Services was the HVAC contractor that monitored refrigeration and environmental systems in Target stores. To provide remote monitoring, Fazio technicians had VPN credentials for Target's network. Attackers compromised Fazio via phishing, harvested those VPN credentials, and used them to access Target's internal network. Because Target's network was not properly segmented between vendor access and production systems, the attackers reached point-of-sale infrastructure across 1,800 stores. The lesson: an HVAC company that seems irrelevant to payment security held the keys to 40 million credit card numbers.

✅ Correct: C. The attackers compromised the build pipeline — the process that compiled source code into an installable package. By the time the code was compiled and signed, it already contained the malicious SUNBURST backdoor. SolarWinds' own code-signing process then applied a genuine, cryptographically valid signature to the malicious package. Every customer's verification check confirmed "this update was signed by SolarWinds" — which was true. The signature didn't lie. The problem is that code signing only proves provenance (who signed it), not safety (that the signed code is benign). If attackers can modify code before the signing step, the signature becomes a false assurance.

✅ Correct: C. This is a hardware supply chain attack — counterfeit networking equipment. The physical failure risk (unexpected device failure, fire in extreme cases) is real but secondary to the security concern. All network traffic flows through switches. A counterfeit switch with unknown firmware could be silently logging, copying, or redirecting traffic. The organization has been operating under the assumption that its network infrastructure is trustworthy, when the actual devices may have been designed to behave otherwise. The immediate response is to remove the suspect devices from production, replace with hardware from authorized sources, and review network traffic logs for evidence of unexpected data flows or exfiltration during the period these devices were in service.

✅ Correct: C. Security is not a static property — it changes as organizations grow, lose key personnel, change ownership, take on technical debt, or face budget pressure. A vendor that was a 10-person company with strong security culture at onboarding may be a 200-person company acquired by a private equity firm six years later, with very different security practices. The trusted access granted at onboarding based on a one-time review remains in force regardless of how the vendor has changed. Periodic security reviews (annual for high-access vendors) ensure the trust relationship remains appropriate to current reality. Note: security certifications (D) represent a point-in-time assessment under a specific framework — they are useful evidence but not a substitute for ongoing relationship-specific reviews.

✅ Correct: B. This is precisely the SolarWinds SUNBURST scenario. Code signing answers one question: "was this signed by the claimed entity?" It does not answer "is this code safe?" If the vendor's build process was compromised before signing, the malicious code is compiled into the product and the vendor signs it with their legitimate key. The signature is authentic — the code is malicious. These are independent properties. Additional controls: (1) Staged deployment — run the update in an isolated test environment for several days and observe behavior before pushing to production; SUNBURST had a dormancy period but behavioral anomalies during activation would be detectable. (2) Behavioral monitoring — network connections made by the software after installation should match its documented behavior. (3) Reproducible builds — a process where the binary can be independently re-compiled from source to verify it matches the distributed package. None of these is perfect, but together they provide layers of detection that pure signature checking cannot.

✅ Correct: C. The CISO's framing is the exact misconception that the Target breach demolished. The risk is not the vendor's industry or size — it is what access that vendor holds. An HVAC company, cleaning contractor, payroll processor, or facilities manager that has VPN credentials, service accounts, or remote access to internal systems holds attack-enabling access regardless of their primary business. Supply chain risk assessments should be driven by a simple question: "Does this vendor have any credentials or access to our internal systems?" If yes, they are a supply chain risk and require appropriate controls — network segmentation, least-privilege access, credential monitoring, and periodic security reviews of their practices.