Supply chain attack

On 13 December 2020 SolarWinds acknowledged that a trojanized Orion update, distributed from March, had been installed by about 18,000 customers, among them US federal agencies. A supply chain attack goes after a trusted link upstream of the target, a software vendor, a service provider or an integrated component, to reach all of its customers by a cascade effect: the federal agencies installed the Orion update themselves. Rather than forcing a thousand doors, the attacker compromises a single one, that of a player whose products or access are widely distributed, and exploits the relationship of trust to propagate the intrusion. This strategy is formidably effective, because it exploits precisely the modern technological dependencies in which every organization relies on a multitude of third parties. For insurance, it is one of the most worrying accumulation scenarios, since a single compromise can generate simultaneous losses across a large number of insureds that shared the same supplier, with no apparent link between them. The underwriting difficulty lies in the opacity of these chains, since an insurer rarely knows the full set of its insureds' software dependencies, and therefore rarely knows its own exposure to a common event hidden behind a second or third-tier provider.