CAPEC-678
System Build Data Maliciously Altered
2021-10-21
00h00 +00:00
00h00 +00:00
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
CAPEC の情報
前提条件
An adversary has access to the data files and processes used for executing system configuration and performing the build.緩和策
Implement configuration management security practices that protect the integrity of software and associated data.Monitor and control access to the configuration management system.
Harden centralized repositories against attack.
Establish acceptance criteria for configuration management check-in to assure integrity.
Plan for and audit the security of configuration management administration processes.
Maintain configuration control over operational systems.
参考文献
REF-439
Supply Chain Attack Framework and Attack PatternsJohn F. Miller.
http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf
REF-660
Supply Chain Attack Patterns: Framework and CatalogMelinda Reed, John F. Miller, Paul Popick.
https://docplayer.net/13041016-Supply-chain-attack-patterns-framework-and-catalog.html
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Description |
