CAPEC-678 Metadata
Likelihood of Attack
Low
Typical Severity
High
Overview
Summary
During the system build process, the system is deliberately misconfigured by the alteration of the build data. Access to system configuration data files and build processes is susceptible to deliberate misconfiguration of the system.
Prerequisites
An adversary has access to the data files and processes used for executing system configuration and performing the build.
Potential Solutions / Mitigations
Implement configuration management security practices that protect the integrity of software and associated data. Monitor and control access to the configuration management system. Harden centralized repositories against attack. Establish acceptance criteria for configuration management check-in to assure integrity. Plan for and audit the security of configuration management administration processes. Maintain configuration control over operational systems.
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-444 | An adversary modifies a technology, product, or component during its development to acheive a negative impact once the system is deployed. The goal of the adversary is to modify the system in such a way that the negative impact can be leveraged when the system is later deployed. Development alteration attacks may include attacks that insert malicious logic into the system's software, modify or replace hardware components, and other attacks which negatively impact the system during development. These attacks generally require insider access to modify source code or to tamper with hardware components. The product is then delivered to the user where the negative impact can be leveraged at a later time. |
Taxonomy Mappings
Taxonomy: ATTACK
| Entry ID | Entry Name |
|---|---|
| 1195.002 | Supply Chain Compromise: Compromise Software Supply Chain |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.