Poisoned Pipeline / Mitigations / M1501
M1501
Require SBOM from all third-party suppliers
An SBOM for every third-party artifact helps to ensure an artifact is safe to use and fully compliant.
This file lists all important metadata, especially all the dependencies of an artifact, and allows for verification of each dependency.
If one of the dependencies/artifacts is attacked or has a new vulnerability (e.g., the "SolarWinds" or even "log4j" attack), it is easier to detect what has been affected by this incident because dependencies in use are listed in the SBOM file.
Applies to
- T0198 Malicious Build Time Dependencies
- T0172 Runtime backdoor
- T0205 Compromise third-party CDN or hosted web asset
- T0206 Forge or omit build provenance
- T0150 Runtime logic bomb
- T0201 Customers compromised