036_Supply Chain Vulnerabilities – CompTIA Security+

What is a key takeaway for supply chain security?

• Trust must be earned and verified

• Trust is irrelevant in supply chain security

• Trust can be assumed without verification

• Trust is only needed for internal stakeholders

What does the supply chain include?

• All steps from raw materials to product delivery

• Only the manufacturing process

• Transportation of finished goods only

• Retail and customer service operations

What is a hardware supply chain risk?

• New devices may have preloaded vulnerabilities

• Hardware components can be easily replicated

• Supply chain disruptions can lead to increased costs

• All hardware is immune to cyber threats

How did attackers first breach Target in 2013?

• Through a phishing attack on an HVAC vendor

• By exploiting a vulnerability in the payment system

• Using stolen credit card information from customers

• Through a DDoS attack on the website

How did attackers distribute malware in the SolarWinds breach?

• By injecting it into software updates

• Through phishing emails

• By exploiting zero-day vulnerabilities

• Using removable media devices

What can happen if a third-party IT service is compromised?

• Sensitive data may be exposed.

• Service downtime may occur.

• User accounts may be locked.

• Software updates may be delayed.

What type of malware was used in the Target breach?

• Register-based malware for stealing card data

• Ransomware for encrypting files

• Spyware for tracking user activity

• Adware for displaying unwanted ads

What happened in the counterfeit Cisco case (2022)?

• Over $1B in fake devices were sold using shell companies

• Cisco launched a new product line

• Cisco reported record profits in 2022

• A major cybersecurity breach occurred at Cisco

What is a key principle of software supply chain security?

• Trust must be verified through digital signatures

• Software must be developed in isolation

• All code must be open source

• Security measures should be optional

What was compromised in the SolarWinds Orion attack?

• The development infrastructure

• User data

• Network security protocols

• Customer service operations