A retailer's network is breached not through its own systems but through the small company that services its heating and cooling, a vendor with remote access that no one thought of as a security risk. The attacker never attacked the retailer directly. They attacked a trusted supplier and walked in through the connection the retailer had already approved.
Supply chain and removable media are two vectors that bypass the perimeter in very different ways: one through the organizations you trust, the other through a physical object someone carries past the firewall. On the CompTIA Security+ SY0-801 exam, objective 2.3 lists supply chain-based vectors (third-party providers, managed service providers, logistics providers and software-as-a-service providers) and external media (malicious USB). This lesson covers how each is used, what it looks like, and the primary defense. Managing vendor risk as a program, contracts, due diligence and monitoring, is a governance topic later in the course; here the subject is the supplier and the device as routes in.
Supply chain vectors reach you through someone you already trust
A supply-chain vector is an attack that reaches you through a product, service or organization you depend on, rather than through a direct assault on your own systems. It works because of trust that is already in place: a vendor has remote access, a supplier's software is installed on your machines, a provider holds your data. The attacker compromises the weaker, trusted party and inherits the access you granted it.
This is one of the hardest categories to defend, because the access is legitimate and the connection is expected. Your own controls may be excellent and still be bypassed, since the attacker enters as a trusted vendor, not as an intruder. The common thread across every item below is concentration of trust: the more access a third party holds, the more a single compromise of that third party gives an attacker. The general defense is therefore to limit and verify that trust, least privilege for every vendor connection, due diligence before granting access, and monitoring of what vendors actually do.
Third-party providers and logistics carry risk you do not control
Third-party providers are the broad category: any outside company integrated into your operations, from the firm that maintains your building systems to a contractor with a login to your network. Each connection a vendor holds is a path an attacker can use if that vendor is compromised, and vendors are often smaller, less defended, and outside your visibility. The classic pattern is a maintenance or support vendor with remote access that becomes the entry point into a far larger target.
Logistics providers are the companies that ship and handle hardware, and they introduce a distinct risk: tampering in transit. Equipment can be intercepted on its way to you, a shipment can be modified or swapped, or counterfeit components can be slipped into the stream, so a device arrives already compromised before it is ever unboxed. Nation-state adversaries are the usual concern here, but ordinary counterfeit parts are a more common version of the same problem. What it looks like is a device that behaves oddly out of the box, or hardware whose provenance cannot be verified.
The defenses are vendor due diligence and least-privilege access for third parties, and for hardware, buying from trusted and authorized sources, verifying devices on receipt, checking firmware integrity, and using tamper-evident shipping for sensitive equipment. On the exam, a breach that arrives through a maintenance or support vendor is the third-party vector, and hardware compromised before delivery points to logistics.