County GIS clients auto-update from a compromised publisher after an email announced the patch. Which named term fits the compromise of that trusted update path?
Select an answer to reveal the explanation.
Short Explanation
The email was just the hallway announcement; the poison was the publisher's auto-update. When a trusted GIS vendor is the delivery path, the named term is supply-chain attack—not phishing. Do not let the announcement mail steal the classification.
Full Explanation
When county GIS clients auto-update from a compromised publisher after an email announced the patch, the named term for compromise of that trusted update path is a supply-chain attack. The email was hallway noise; the poison was the publisher's auto-update mechanism. Civic GIS estates are high-value because maps and parcel systems underpin many public services, and trusted update abuse must be labeled supply-chain—not merely phishing because an announcement mail existed.
Calling it phishing because staff received an email about the update fails by concept: the compromise path is the trusted publisher update, not the announcement lure as the payload delivery. Calling it ransomware because GIS data could later be encrypted fails by concept: hypothetical later encryption does not rename the update-path compromise. Calling it DDoS because the publisher CDN was busy fails by concept: CDN load is not the attack type described.
Exam caveat: Abuse of trusted auto-update = supply-chain attack even if email announced the patch.
Operational check: Pause GIS auto-updates, validate publisher integrity, hunt endpoints that pulled the bad update, and separate "announcement phishing" investigations from the supply-chain update compromise track in ES.