An attack that breaches an organization indirectly by compromising a trusted third-party vendor, software dependency, or hardware supplier is known as a(n) _____-chain attack.

### Why this is right The missing term completes the course material's list of continuing concerns: supply-chain attacks. A supply-chain attack targets an organization through a supplier, vendor, or other part of the chain on which it depends, though the slides do not give a specific example. ### The concept The list shows that organizations face several categories of cybersecurity concern. Some relate to malicious software, such as ransomware; some involve stolen credentials or insiders; others relate to cloud environments or dependencies on external suppliers. Naming a threat category helps an organization decide what to examine during an assessment. The list is illustrative, not a complete catalog of every possible threat. ### Terms - **Ransomware**: Malicious software that restricts access to data or systems, often to demand payment. - **Credential theft**: Unauthorized acquisition of information used to verify identity, such as a password. - **Insider threat**: A risk arising from someone with legitimate access to an organization or its systems. - **Cloud attack**: An attack directed at cloud-based systems, services, or data. - **Supply-chain attack**: An attack that exploits a supplier or another dependency to affect an organization. ### Remember Learn the five threat categories as examples of what an organization may need to assess.