CISA and NIST Release New Interagency Resource: Defending Against Software Supply Chain Attacks
Cybersecurity and Infrastructure Security Agency sent this bulletin at 04/26/2021 03:02 PM EDT
You are subscribed to no topic for Cybersecurity and Infrastructure Security Agency. This information has recently been updated, and is now available.
A software supply chain attack—such as the recent SolarWinds Orion attack—occurs when a cyber threat actor infiltrates a software vendor’s network and employs malicious code to compromise the software before the vendor sends it to their customers. The compromised software can then further compromise customer data or systems.
To help software vendors and customers defend against these attacks, CISA and the National Institute for Standards and Technology (NIST) have released Defending Against Software Supply Chain Attacks. This new interagency resource provides an overview of software supply chain risks and recommendations. The publication also provides guidance on using NIST’s Cyber Supply Chain Risk Management (C-SCRM) framework and the Secure Software Development Framework (SSDF) to identify, assess, and mitigate risks.
CISA encourages users and administrators to review Defending Against Software Supply Chain Attacks and implement its recommendations.
This product is provided subject to this Notification and this Privacy & Use policy.