The Cybersecurity & Infrastructure Security Agency and the National Institute of Standards and Technology have jointly published a new resource as part of their ongoing efforts to promote awareness of – and help organizations defend against – supply chain risks. The publication, Defending Against Software Supply Chain Attacks, provides recommendations for software customers and vendors as well as key steps for prevention, mitigation, and resilience of software supply chain attacks. The resource highlights three common, and not mutually exclusive, software supply chain attack techniques: highjacking updates, undermining codesigning, and compromising open-source code.
Source: