01815nam a2200193   4500001000700000010001800007100004100025101000800066200006800074210006700142215002000209300004800229330122500277606002401502606003001526606003001556606002501586710001001611396366  a9789292045098  a20210930u           y0pory50      ba  aeng  aThreat landscape for supply chain attacksbRecurso eletrónico  a[Attiki]cEuropean Union Agency for Cybersecurity, ENISAd2021  a1 CD-ROMd12 cm  aFicheiro de 4,78 MB em formato PDF (57 p.).  aIntroduction. 2. What is a supply chain attack? 2.1. Taxonomy of supply chain attacks. 2.2. Attack techniques used to compromise a supply chain. 2.3. Supplier assets targeted by a supply chain attack. 2.4. Attack techniques used to compromise a customer. 2.5. Customer assets targeted by a supply chain attack. 2.6. How to make use of the taxonomy. 2.7. Supply chain taxonomy and other frameworks. 2.7.1. MITRE ATT&CK® Knowledge Base. 2.7.2. Lockheed Martin Cyber Kill Chain® Framework. 3. The lifecycle of a supply chain attack. 4. Prominent supply chain attacks. 4.1. Solarwinds orion: it management and remote monitoring. 4.2. Mimecast: cloud cybersecurity services. 4.3. Ledger: hardware wallet. 4.4. kaseya: it management services compromised with ransomware. 4.5. an example of many unknowns: sita passenger service system. 5. Analysis of supply chain incidents. 5.1. Timeline of supply chain attacks. 5.2. Understanding the flow of attacks. 5.3. Goal oriented attackers. 5.4. Most attack vectors to compromise suppliers remain unknown.  5.5. Sophisticated attacks attributed to apt groups. 6. Not everything is a supply chain attack. 7. Recommendations. 8. Conclusions. Annex A: summary of supply chain attacks.  aCRIME INFORMÁTICO  aSEGURANÇA INFORMÁTICA  aPROTECÇÃO DE SOFTWARE  aSEGURANÇA DE DADOS  aENISA