CAPEC-673 詳細

前提条件

An adversary would need to have access to a targeted developer’s software development environment, including to their software build processes, where the adversary could ensure code maliciously tainted prior to a build process is included in software packages built.

必要なスキル

The adversary must have the skills to infiltrate a developer’s software development/build environment and to implant malicious code in developmental software code, a build server, or a software repository containing dependency code, which would be referenced to be included during the software build process.

緩和策

Have a security concept of operations (CONOPS) for the IDE that includes: Protecting the IDE via logical isolation using firewall and DMZ technologies/architectures; Maintaining strict security administration and configuration management of configuration management tools, developmental software and dependency code repositories, compilers, and system build tools.
Employ intrusion detection and malware detection capabilities on IDE systems where feasible.

参考文献

REF-658

Defending Against Software Supply Chain Attacks
https://www.cisa.gov/sites/default/files/publications/defending_against_software_supply_chain_attacks_508_1.pdf

REF-659

Deliver Uncompromised: Securing Critical Software Supply Chains
Dr. Charles Clancy, Joe Ferraro, Robert A. Martin, Adam G. Pennington, Christopher L. Sledjeski, Dr. Craig J. Wiener.
https://www.mitre.org/publications/technical-papers/deliver-uncompromised-securing-critical-software-supply-chains

登録情報

変更履歴