The Supply Chain: Software, Hardware, and Firmware
You inherit the security of everyone who touched your stack before you did. Every dependency, every firmware image, every board in every server is a decision made by someone you will never meet, and a state actor knows it is easier to poison the well than to fight you at the tap. Supply-chain compromise is force multiplication: subvert one upstream component and you reach every downstream victim at once, with the defender's own trust carrying the payload through the front door. The perimeter you must defend is not your building. It is the entire genealogy of your systems.
Knowledge check
What makes a supply-chain attack more efficient for a state actor than attacking each target network directly?
Show the answer
A single compromise of a widely used upstream component, such as a popular software dependency or a vendor's build pipeline, propagates automatically to every organization that trusts and installs it. One operation yields many victims, and because the malicious code arrives through a channel the defender already trusts, it bypasses defenses aimed at external intruders.