Exam CISM topic 1 question 721 discussion

A supply chain attack is a type of cyber attack in which the attacker targets an organization by compromising its suppliers or third-party resources that are part of the organization's supply chain. By infiltrating these third-party resources, an attacker can gain access to sensitive information, install malware, or compromise critical assets that would otherwise be secure. This type of attack can result in significant consequences for an organization, including data breaches, reputational damage, legal liability, and business disruption. As such, the most likely risk scenario to emerge from a supply chain attack is the compromise of critical assets, which can have a significant impact on an organization's operations, security, and reputation.

D Supply chain attacks are evolving threats that target third-party software suppliers. A software supply chain attack occurs when a cyber threat actor compromises the software before the supplier sends it to their customers. One successful intrusion can have a ripple effect and can potentially impact thousands of victims.

D. Compromise of critical assets via third-party resources