You secure your own systems carefully. But what about the software your IT provider installs? The accounting system your bookkeeper uses? The PDF tool your team downloaded last month? Supply chain attacks compromise trusted software or services to attack the businesses that use them.
In December 2020, SolarWinds — a major network monitoring software vendor used by thousands of organisations worldwide — disclosed that their software update mechanism had been compromised. Attackers had inserted malicious code into a legitimate software update, which was then distributed to approximately 18,000 SolarWinds customers. Among those customers were the US Treasury, the Department of Homeland Security, and numerous Fortune 500 companies.
The attack wasn't particularly sophisticated in its technique — it was sophisticated in its target. Rather than attacking 18,000 organisations individually, the attackers compromised one trusted vendor and used that trust to reach all of their customers simultaneously.
Supply Chain Attacks in the NZ SMB Context
SolarWinds was a nation-state attack targeting government and large enterprise. But the supply chain attack pattern scales down to NZ small business contexts in several ways:
Compromised IT providers: MSPs (Managed Service Providers) have privileged access to their clients' systems. An attacker who compromises an MSP's remote management tools gains access to every client that MSP manages. This is why the security posture of your IT provider matters — their security is your security. Optimyze maintains security certifications and undergoes regular third-party security assessments specifically because of this trust relationship.
Malicious software updates: 3CX's desktop application was compromised in 2023 — the legitimate app included a malicious payload distributed through the official update channel. Users who updated their 3CX software installed malware without any indication of anything wrong. This attack affected businesses globally, including NZ companies running 3CX.
Compromised SaaS tools: Accounting software, CRM systems, and other cloud services used by NZ businesses have been targeted specifically to reach the businesses that trust them. A compromised bookkeeping application that has OAuth access to your Microsoft 365 tenant can exfiltrate email and files without any credential theft needed.
How to Reduce Supply Chain Risk
Audit third-party access: Review which applications and services have OAuth or API access to your Microsoft 365 tenant or other business systems. Revoke access for any application that is no longer actively used. For Microsoft 365, this is visible in the Microsoft Entra admin portal under Enterprise Applications.
Principle of least privilege for service accounts: If a supplier system needs API access to your environment, scope it to the minimum permissions necessary. An invoicing system doesn't need read access to your email. A CRM integration doesn't need file system access.
Vet your IT providers: Ask your IT provider whether they have cyber insurance, what security practices protect their management infrastructure, and whether they use privileged access workstations for managing client environments. An MSP that can't answer these questions is a supply chain risk.
Your security is only as strong as the weakest link in your supply chain. The trust you extend to software vendors, SaaS providers, and IT partners creates risk that doesn't show up in your own security posture assessments.
