CAPEC 정보

사전 조건

Access to the configuration management system during deployment or currently deployed at a victim location. This access is often obtained via insider access or by leveraging another attack pattern to gain permissions that the adversary wouldn't normally have.

완화 방법

Assess software during development and prior to deployment to ensure that it functions as intended and without any malicious functionality.
Leverage anti-virus products to detect and quarantine software with known virus.

참고 자료

REF-379

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2nd Draft)
Jon Boyens, Angela Smith, Nadya Bartol, Kris Winkler, Alex Holbrook, Matthew Fallon.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-draft2.pdf

REF-706

Chef Manage deserializes cookie data insecurely
https://www.kb.cert.org/vuls/id/586503

제출

이름	조직	날짜	출시일
CAPEC Content Team	The MITRE Corporation	2014-06-23 +00:00

수정 사항

이름	조직	날짜	댓글
CAPEC Content Team	The MITRE Corporation	2018-07-31 +00:00	Updated Attack_Motivation-Consequences, Attack_Prerequisites, Description Summary, Solutions_and_Mitigations, Typical_Likelihood_of_Exploit, Typical_Severity
CAPEC Content Team	The MITRE Corporation	2019-09-30 +00:00	Updated Related_Attack_Patterns
CAPEC Content Team	The MITRE Corporation	2021-06-24 +00:00	Updated Related_Attack_Patterns
CAPEC Content Team	The MITRE Corporation	2022-02-22 +00:00	Updated Description, Example_Instances, Extended_Description, References
CAPEC Content Team	The MITRE Corporation	2022-09-29 +00:00	Updated Description, Extended_Description, Related_Attack_Patterns, Taxonomy_Mappings

CAPEC-445 상세 정보

CAPEC-445