Trusted Relationship

What it means

Trusted relationship abuse reaches a target through another organization or identity that already has access. The existing connection can bypass assumptions about ordinary external entry points.

An investigation example

A supplier account performs a new administrative action in the customer's environment after suspicious activity at the supplier.

Evidence to examine

Review delegated privileges, access history, approval records, customer-side actions, and available partner evidence.

A common analytical pitfall

Partner status does not prove each action was approved, while unusual activity does not establish compromise without corroboration.

Response considerations

Constrain confirmed affected partner access and coordinate evidence-based investigation through established organizational procedures.

Existing access can become an intrusion path

Organizations often grant suppliers and partners access for support, administration, integration, or shared work. An intruder who compromises that other party may use the established relationship to reach the target. The access can appear familiar because the account or connection already belongs to an approved workflow. Authorization still depends on purpose, identity control, and scope.

This differs from every form of supply-chain compromise. Trusted-relationship abuse concerns leveraging existing access, while malicious modification of a distributed product involves another upstream path. Both can coexist, but investigations should describe the mechanism supported by evidence rather than use the terms interchangeably.

A fictional support-provider session

An academy's managed provider has limited administrative access to its cloud service. A session from that relationship performs changes outside the normal support process. Analysts preserve identity, delegation, session, approval, and resource-change records. They coordinate with the provider through established contacts without assuming that every provider employee or customer is affected.

Containment may require restricting delegated access while preserving an emergency support route. Review the scope of the relationship and the authority actually exercised. Revoking one credential can be insufficient if other delegated permissions or active sessions remain. The appropriate actions depend on the platform and established facts.

Map a supplier boundary

Create a fictional diagram showing a provider identity, the academy's service, approved actions, and audit records. Identify who can grant and revoke the relationship and how its continued need is reviewed. Then state evidence that would distinguish approved support from unauthorized use of the same access.

A contract or assurance report can inform governance but does not replace operational control of the access path. Keep ownership, incident communication, and exit arrangements clear. The relationship should support a defined service purpose rather than become indefinite broad authority because it was convenient during onboarding.

Related concepts

• MITRE ATT&CK
• Logs and telemetry
• Incident response
• Valid Accounts