CAPEC-524 Metadata
Likelihood of Attack
Low
Typical Severity
High
Overview
Summary
An attacker alters or establishes rogue processes in an integration facility in order to insert maliciously altered components into the system. The attacker would then supply the malicious components. This would allow for malicious disruption or additional compromise when the system is deployed.
Prerequisites
Physical access to an integration facility that prepares the system before it is deployed at the victim location.
Potential Solutions / Mitigations
Deploy strong code integrity policies to allow only authorized apps to run. Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities. Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and requiring multi-factor authentication for admins. Require SSL for update channels and implement certificate transparency based verification. Sign everything, including configuration files, XML files and packages. Develop an incident response process, disclose supply chain incidents and notify customers with accurate and timely information. Maintain strong physical system access controls and monitor networks and physical facilities for insider threats.
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-439 | An attacker undermines the integrity of a product, software, or technology at some stage of the distribution channel. The core threat of modification or manipulation during distribution arise from the many stages of distribution, as a product may traverse multiple suppliers and integrators as the final asset is delivered. Components and services provided from a manufacturer to a supplier may be tampered with during integration or packaging. |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.