Ride the Lightning

NIST and CISA: New Resource Released – Defending Against Software Supply Chain Attacks

May 5, 2021

Nothing sexy about software supply chain attacks. But a resource that helps defend against them is worthy of note.

A software supply chain attack—such as the recent SolarWinds Orion attack—takes place when a cyber threat actor infiltrates a software vendor’s network and employs malicious code to compromise the software before the vendor sends it to their customers. The compromised software can then further compromise customer data or systems.

The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) announced on April 26 that they had released Defending Against Software Supply Chain Attacks.

This new interagency resource provides an overview of software supply chain risks and recommendations. The publication also provides guidance on using NIST’s Cyber Supply Chain Risk Management (C-SCRM) framework and the Secure Software Development Framework (SSDF) to identify, assess, and mitigate risks.

At 16 pages, a cup of strong coffee ought to get you through the essence of defending against software supply chain attacks.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email:  Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson