Every IT company on earth, ours included, tells you the same thing. Patch your systems. Install updates promptly. Do not let software sit six versions behind. Good advice, and we are not walking it back.
But there is an uncomfortable footnote, and business owners deserve to hear it honestly rather than discover it later. On a handful of occasions, the update itself has been the attack. Legitimate software from a legitimate vendor, downloaded through the normal channel, digitally signed and everything, carrying something it should not have been carrying. This is called a software supply chain attack, and understanding it correctly is important, because the wrong conclusion from it is genuinely dangerous.
What a Supply Chain Attack Actually Is
CISA and NIST published a joint resource on this in 2021 titled Defending Against Software Supply Chain Attacks, and their definition is about as clear as it gets: a software supply chain attack occurs when a cyber threat actor infiltrates a software vendor’s network and employs malicious code to compromise the software before the vendor sends it to their customers.
Think about your restaurant supplier. You inspect deliveries at your own back door. But if somebody tampered with a case of produce back at the warehouse, your inspection does not help much, because the box is sealed, the paperwork is right, and the truck is the truck you have used for six years. Everything about the delivery is legitimate except the contents.
The reason attackers bother is leverage. Compromise one vendor and you reach every customer that vendor has, through a channel those customers were trained to trust. The CISA and NIST resource published in 2021 notes that vendors typically distribute updates from centralized servers as a routine part of product maintenance, which is exactly what makes that channel attractive.
The General Shapes This Takes
You do not need the technical details. You do need to recognize the categories, because they tell you where to look. The CISA and NIST resource published in 2021 describes three common techniques, and we would add a fourth that matters to small businesses.
- Hijacked updates. Someone gets into the vendor’s build or distribution process and the malicious code ships out through the normal update pipeline to everybody at once.
- Undermined code signing. Digital signatures are how your computer verifies that software really came from who it claims. When that signing process is subverted, the tampered software still shows up as authentic, and your computer has no reason to complain.
- Compromised open source components. Modern software is assembled from shared building blocks. Poison a popular block and it flows into every product that uses it, often without those product makers realizing what they inherited.
- Compromised management tooling. The remote monitoring and administration software that IT providers use to manage many clients is a high value target for the same reason: one compromise, many downstream businesses. This is worth asking your own IT provider about, and a good one will answer without getting defensive.
Why This Is Not an Argument Against Patching
We want to be extremely clear here, because we have watched owners draw exactly the wrong lesson from this and stop updating anything.
Compare the two risks honestly. A supply chain compromise requires an attacker to breach a software vendor and poison a release. It is rare, expensive, and draws enormous attention when it happens. An unpatched vulnerability in software you already run is public knowledge, documented in detail, and scanned for continuously by automated tools that do not care how small your business is. One is a lightning strike. The other is leaving the back door propped open on a busy street.
The overwhelming majority of small business compromises we see trace back to something that had a fix available and did not have it installed. The CISA and NIST resource published in 2021, even while describing supply chain attacks, recommends that customers implement a documented vulnerability management program and configure software to automatically check for and install patches. The agencies documenting the risk still say patch. So do we. The right response is not to stop updating. It is to update with a little more structure.
The Precautions That Are Actually Worth Your Time
Here is what a sensible small or mid sized business can genuinely do about this. None of it requires a security team.
- Know what software you actually run. The CISA and NIST resource published in 2021 puts software inventory near the top of its customer recommendations, including documented inventories and understanding how each application supports critical business processes. When news breaks about a compromised product, the businesses that answer “are we affected” in ten minutes are the ones with a list.
- Roll updates out in stages. Put major updates on a few machines first, wait a short window, then push to everyone. That costs a couple of days and buys the chance that a bad release gets caught by the wider world before it reaches your whole company. Keep fixes for actively exploited flaws on the fast track. Staging is for routine updates, not emergencies.
- Watch what happens after a major update. The CISA and NIST resource published in 2021 recommends monitoring for unauthorized configuration changes and unexplained deviations from your software inventory. In practice: if a familiar application starts reaching out to places it never went before, that is worth a phone call rather than a shrug.
- Ask your vendors real questions. The same 2021 resource suggests asking whether a vendor uses a secure software development process, whether it actively identifies and discloses vulnerabilities, and whether it can provide evidence of security testing. You do not need to audit anyone. You need to see whether a straight question gets a straight answer.
- Keep backups that let you go backward. Tested backups plus known good system images turn a bad update from a crisis into an afternoon. Two conditions matter: they must be tested by actually restoring something, and stored where a compromised system cannot reach in and delete them.
- Have a plan you have said out loud. The 2021 CISA and NIST resource recommends playbooks for supply chain compromise and periodic tabletop exercises. For a twenty person company that is one page and a twenty minute conversation. Who calls whom, what gets disconnected first, where the backups live.
The Bottom Line
Trust in software is not optional. You cannot inspect the source code of your accounting package, and neither can we. Every business runs on software it did not write and cannot fully verify. That is not a failure of diligence, it is just how the modern world is built. NIST has framed it plainly, describing software as a critical component of the larger challenge of managing cybersecurity related to supply chains.
So the goal is not eliminating that trust. It is limiting what any single act of trust can cost you. Know your software. Stage your rollouts. Watch after big changes. Ask vendors direct questions and notice how they answer. Keep backups that actually restore. Do those five things and a bad update becomes an inconvenience instead of an existential event.
And keep patching. The rare risk gets the headlines, but the ordinary one is what takes companies offline. Our post on why cybersecurity is no longer optional for mid-sized businesses covers the wider case, and it helps to know what is running on your network in the first place, which is where shadow IT quietly undermines every inventory you think you have.
If you would like help building a real software inventory, setting up staged patching, or testing whether your backups would actually bring you back, that is core work for us. We support small and mid sized businesses throughout Denton County and are happy to start with a straightforward conversation. Contact us today.
Sources:
Comments are closed