Supply-chain attacks compared

Try it out loud first. Then check yourself:

1. SolarWinds: compromised vendor build system, signed malicious update pushed to ~18,000 customers
2. NotPetya: hijacked M.E.Doc update server delivered a destructive wiper
3. xz-utils: social-engineered open-source maintainership, backdoor hidden in release tarballs
4. MOVEit: not a build compromise but one product zero-day mass-exploited across thousands of orgs
5. Common defenses: SBOM, build provenance (SLSA), vendor risk tiers, least privilege and egress control for vendor software

If the interviewer pushes back

• Which of these would SBOMs have helped with, and which not at all?

Go deeper

• www.cisa.gov/sbom