Gartner发布降低软件供应链安全风险指南
需积分: 5 165 浏览量
2023-11-28
19:00:38
上传
评论
收藏 308KB PDF 举报
Gartner, Inc. | G00762170
Page 1 of 20
Mitigate Enterprise Software Supply Chain Security
Risks
Published 31 October 2023 - ID G00762170 - 27 min read
By Analyst(s): Dale Gardner
Initiatives: Security of Applications and Data; Build and Optimize Cybersecurity Programs;
Demonstrate Value and Collaborate With Business Partners
Software supply chain attacks have seen triple-digit increases, but
few organizations have taken steps to evaluate the risks of these
complex attacks. This research provides three practices security
and risk management leaders can use to detect and prevent
attacks, and protect their organizations.
Overview
Key Findings
Recommendations
Security and risk management (SRM) leaders have gained expertise in addressing supply
chain issues in internal application development. They can use this knowledge by helping
their organizations in following three practices:
Despite a dramatic rise in software supply chain attacks, security assessments are
not performed as a part of vendor risk management or procurement activities. This
leaves organizations vulnerable to attacks.
■
Security teams struggle to respond to vulnerabilities, especially where that
vulnerability is included within software dependencies. Because software
components have not been traditionally disclosed, their content is often opaque to
teams trying to ascertain whether they are affected. This requires extraordinary work
to identify affected software and implement risk mitigations.
■
Formal testing and evaluation of commercial software for potential vulnerabilities or
malicious code are rarely performed by customers — even for systems supporting
high-value or sensitive processes. The lack of formal testing creates a path for
lateral movement, and facilitates the introduction of malicious code that steals data
and intellectual property.
■
This research note is restricted to the personal use of chenlizhen@qianxin.com.
剩余19页未读，继续阅读
资源评论
