Critical severityHARDEC6 steps · 6 phases
Supply Chain Compromise Response
Software supply chain takeover (malicious update, trojanized package, build system). SolarWinds, 3CX, XZ Utils examples. Source: SANS FOR610 + CISA AA23-144A.
Information note
Informational note: In supply chain breach response, definitively identify which component (software update, development tool, or third-party library) was compromised and bring all systems using the same vendor into scope (MITRE T1195). Verify the integrity of the trusted build environment by reviewing software signature validation (code signing) and SBOM (Software Bill of Materials) records. Also investigate potential abuse of cloud-based OAuth tokens.
1
Preparation
1 steps- Establish supply chain visibility
Maintain SBOM for critical software, subscribe to vendor security notifications, monitor hash values of critical applications.
2
Identification
1 steps- Assess the scope of the compromise
Which software was affected? Which versions? How many systems in the environment are running the affected version? What did the malicious code do?
3
Containment
1 steps- Isolate affected systems
Place all systems running the affected software into network isolation. Block C2 domains/IPs. Reset exposed credentials.
4