Supply chain access and third-party infrastructure¶

External organisations holding legitimate access to your target represent a shortcut past direct compromise. A supplier with standing administrative credentials, an integrator with persistent VPN access, a managed service provider with privileged accounts, or a cloud infrastructure partner with API keys all provide pre-authorised pathways into the target that exist outside the target’s own security perimeter. The question is whether compromising the third party is cheaper than compromising the target directly.

Categories of third-party access¶

Third parties access target environments through multiple mechanisms, each carrying different operational characteristics.

Integrators and implementation partners hold access during deployment and commissioning phases. A systems integrator building a cloud migration holds administrative credentials and API access to configure infrastructure, migrate data, and establish operational baselines. After deployment concludes, this access often remains indefinitely, sitting outside normal credential rotation and access review cycles. An industrial automation integrator commissioned to install control systems holds engineering access to programmable logic controllers and may retain credentials to support future maintenance calls.

Managed service providers operate under service agreements granting ongoing administrative access. A managed IT provider monitoring infrastructure holds privileged credentials across servers, networks, and security systems. An outsourced security operations centre holds read access to security logs and sometimes incident response authority. These relationships are contractual and ongoing, creating stable access vectors that outlast individual deployments.

Vendors providing software or appliances as a service often retain administrative access for deployment, patching, and troubleshooting. A SaaS provider manages your application infrastructure and holds credentials to that infrastructure. A security appliance manufacturer holds access for remote support, updates, and diagnostics. This access is typically necessary for the vendor to provide the contracted service but creates a persistent pathway independent of your own credential management.

Supply chain partnerships embed access deeper. A payment processor holds credentials to validate transactions and may hold access to transaction databases. A logistics provider has visibility into shipment tracking systems and inventory databases. A cloud infrastructure provider has metadata service access that applications running on their platform depend on. These partnerships create dependencies where the third party’s compromise extends automatically to systems they’re integrated with.

Asymmetry of compromise cost¶

Compromising a third party is often cheaper than compromising the target directly. A target organisation invests in perimeter defences, endpoint security, identity and access management, and security operations. A supplier is often smaller, less defended, and assumes they are less attractive a target than the organisations they serve.

An integrator that completed its implementation contract years ago may have zero ongoing security reviews, static credentials that were never rotated, and minimal monitoring. A managed service provider operating across dozens of clients may have weaker authentication controls than any individual client requires. A vendor providing niche software may lack resources to implement the same security practices as the organisations depending on their software.

Credential reuse across clients amplifies this asymmetry. A managed service provider using the same set of privileged credentials across multiple customers creates a single compromise affecting many targets. An integrator using the same deployment credentials across similar installations means one credential set opens multiple organisations.

Against this asymmetry, targeting the third party directly is rational. Compromising the vendor is cheaper than compromising the target directly, and the access is often as broad or broader.

Operational advantages of third-party access¶

Access through a third party carries specific operational advantages over direct compromise. First, attribution difficulty. An integrator account accessing infrastructure is expected behaviour; defenders assume it is legitimate traffic related to an ongoing service contract or maintenance. A managed service provider’s credentials accessing logs are normal activity; defenders see routine monitoring rather than unauthorised access. The access is authorised from the third party’s perspective and expected from the target’s perspective, creating a blind spot.

Second, detection avoidance. Third-party access often bypasses monitoring that would catch direct intrusion. An integrator’s VPN connection reaches the target’s network directly from an approved external IP address that has no firewall restrictions. A vendor’s API key has explicit permissions to access the service it manages, and that access generates logs that look routine rather than anomalous. Defenders monitoring for unusual access patterns see no pattern; the access is expected.

Third, persistence without maintenance. Third-party credentials often remain valid for years without rotation because the relationship is ongoing and the compromise is not detected. An integrator contract retains the same credentials across the contract period. A vendor relationship persists through multiple product versions and deployments. The access does not degrade over time the way a directly-implanted persistence mechanism might.

Fourth, operational legitimacy. Actions taken through third-party credentials appear to come from the third party, not from an external attacker. If a managed service provider’s account accesses sensitive data, defenders attribute it to the provider’s monitoring activities rather than unauthorised extraction. If an integrator’s credentials deploy changes, the changes appear to be maintenance rather than compromise.

Challenges and constraints¶

Third-party access carries risks that direct access does not. The compromise of a third party may be discovered during their next audit or when they begin a new engagement elsewhere. A vendor account used for exploitation may trigger alerts if the vendor is actively monitoring for abuse. A supplier may rotate credentials after a security incident, invalidating the access immediately.

Constraining third-party access creates friction. A managed service provider account that can administer your entire infrastructure may have restrictions preventing data extraction (they monitor for exfiltration). An integrator account may have MFA requirements that prevent use without the integrator’s physical device. A vendor account may have IP address restrictions limiting access to expected locations.

Third-party relationships are also visible. A target organisation can audit which third parties have access, when they last used it, and what actions they performed. Discovery of unusual access patterns on third-party credentials is often easier than detecting direct attacker intrusion because third-party access is expected to follow specific patterns and occurs at predictable times.

Staging through third parties¶

Some operations use third-party compromise as a staging point rather than the final position. A managed service provider account provides a legitimate pathway to deploy attacker infrastructure, establish persistence, create new accounts, or provision new access that the attacker controls directly. The third-party access itself is temporary; it exists to establish more durable attacker-controlled access.

This strategy mitigates the detection risk of third-party compromise. If the third-party credential is eventually discovered and invalidated, the attacker’s actual access (through accounts and persistence installed using the third-party pathway) remains functional. The third-party access was a ladder to climb; discarding it after reaching the top leaves no relationship between the third party and the attacker’s persistent presence.

Staging also allows establishing access that looks like the third party set it up. A managed service provider installing a new agent for monitoring purposes creates a legitimate-looking foothold that defenders attribute to the provider’s normal activities. An integrator deploying a configuration management tool establishes persistence that appears part of the integrator’s deployment package.

Lifecycle and discovery¶

Third-party access persists as long as the relationship persists. An integrator account used years after the integration project remains valid until explicitly revoked or the contract ends. A managed service provider account continues supporting ongoing operations indefinitely. A vendor account persists through product lifecycle until the vendor or client terminates the relationship.

This persistence creates a detection window. Auditing third-party access is an infrequent activity in many organisations; annual or semi-annual reviews of external accounts are common but not universal. A compromised third-party account may remain undetected through multiple quarterly security reviews because nobody expected to check it.

Discovery of third-party compromise usually comes during two events. First, when the third party undergoes a security incident or audit that reveals the account was misused. Second, when the target organisation conducts a comprehensive access review and notices unusual activity patterns on external accounts. A managed service provider noticing that their credentials were used during off-hours or accessing systems outside their normal scope raises alarms directly.

Once third-party compromise is discovered, remediation is swift. The target revokes the credentials immediately, potentially terminating the third-party relationship until they remediate. The third party may discover the same compromise affecting other clients, leading to cascade effect: multiple targets simultaneously lose the compromised access vector.

Choosing third-party vs. direct compromise¶

Compromising a supplier is rational when the supplier is demonstrably weaker than the target, when the target’s defences are strong enough that direct access is prohibitively expensive, or when the third party’s access reaches further into the target than most direct access paths would. It is irrational when the third party has good security practices, implements access controls that constrain what the attacker can do, or when the direct compromise path is already open.

The choice also depends on operational timeline. Direct compromise takes time (reconnaissance, exploitation, persistence). Third-party compromise may take longer (researching third parties, identifying the weakest one, compromising them) but may reach the target faster once the third party is controlled. If the timeline is compressed, direct compromise may be faster. If the timeline permits longer planning, third-party compromise may be cheaper.