Poisoned Pipeline / Mitigations / M1503
M1503
Implement SCA analysis
Component Analysis is the process of identifying potential areas of risk from the use of third-party and open-source software and hardware components.
The best option for implementing SCA analysis is integration of SCA analysis tools into your CI/CD environment in order to scan your source code dependencies before the release.
Applies to
- T0152 IDE
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0102 Discover used open-source dependencies
- T0164 Inject malicious dependency to privileged user repository
- T0157 Combosquatting
- T0101 Discover technology stacks
- T0151 Installation scripts
- T0100 Discover naming conventions
- T0172 Runtime backdoor
- T0116 Shadow IT
- T0197 Use code from untrusted source
- T0194 Outdated software components
- T0110 Advertise malicious artifact
- T0107 Discover internal artifacts names
- T0150 Runtime logic bomb
- T0203 Discover localized out-of-band deployments
- T0121 Compromised legitimate artifact
- T0108 Accounts in public registry
- T0191 Malicious code in artifacts
- T0111 Malicious code contribution to an open-source repository
- T0136 Brandjacking