A managed service provider's remote monitoring platform is breached, and the attacker uses it to push a malicious script to every client endpoint the provider manages, including the company's laptops. Which threat vector does this represent?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a building's master key held by a cleaning company. If someone steals that key, every tenant's door is open at once. When a trusted provider's tools get turned against you, that's a supply chain vector -- and the blast radius covers every customer they manage.
Full Explanation
Supply chain-based vectors exploit trusted relationships with third-party providers, managed service providers, logistics providers and software as a service providers. A managed service provider usually holds privileged, persistent access to its clients' systems through remote monitoring and management platforms. When that platform is compromised, the attacker inherits the provider's trust and can deploy code to every client simultaneously, which is why this vector is so damaging. A message-based vector through a collaboration tool would depend on a person opening content posted in a chat channel, but here the script was pushed directly through a management agent without user interaction. An external media-based vector requires a physical device such as a malicious USB drive, and nothing was physically delivered. A physical-based vector involving cloned access passes concerns entry into facilities, while this attack was conducted entirely through remote tooling. Exam caveat: the company's own controls were bypassed because the provider's agent is trusted, so third-party risk assessments must cover the provider's security as well as its service levels. Operational check: disable or isolate the provider's agent, identify every endpoint that ran the script, review the contract for incident notification duties, and restrict the provider's access to least privilege going forward.