CAPEC-678 상세 정보

사전 조건

An adversary has access to the data files and processes used for executing system configuration and performing the build.

완화 방법

Implement configuration management security practices that protect the integrity of software and associated data.
Monitor and control access to the configuration management system.
Harden centralized repositories against attack.
Establish acceptance criteria for configuration management check-in to assure integrity.
Plan for and audit the security of configuration management administration processes.
Maintain configuration control over operational systems.

참고 자료

REF-439

Supply Chain Attack Framework and Attack Patterns
John F. Miller.
http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf

REF-660

Supply Chain Attack Patterns: Framework and Catalog
Melinda Reed, John F. Miller, Paul Popick.
https://docplayer.net/13041016-Supply-chain-attack-patterns-framework-and-catalog.html

제출

수정 사항