Narrowing the Software Supply Chain Attack Vectors: The SSDF Is Wonderful but not Enough

IF 2.9 4区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

IEEE Security & Privacy Pub Date : 2024-04-02 DOI:10.1109/msec.2024.3359798

Laurie Williams

引用次数: 0

Abstract

Recent years have shown increased cyberattacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-known examples of software supply chain attacks are the SolarWinds or log4j incidents that have affected thousands of customers and businesses. In 2023, Sonatype1 reported the detection of 245,000 malicious packages, double the number of malicious packages discovered in 2019–2022 combined.

查看原文本刊更多论文

缩小软件供应链攻击向量：SSDF 虽好但还不够

近年来，针对软件供应链中安全性较低要素的网络攻击不断增加，给企业和组织造成了致命的损害。过去众所周知的软件供应链攻击案例包括 SolarWinds 或 log4j 事件，这些事件影响了成千上万的客户和企业。2023 年，Sonatype1 报告检测到 24.5 万个恶意软件包，是 2019-2022 年发现的恶意软件包数量总和的两倍。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

IEEE Security & Privacy 工程技术-计算机：软件工程

CiteScore

4.30

自引率

5.30%

发文量

159

审稿时长

6-12 weeks

期刊介绍： IEEE Security & Privacy’s primary objective is to stimulate and track advances in security, privacy, and dependability and present these advances in a form that can be useful to a broad cross-section of the professional community—ranging from academic researchers to industry practitioners. It provides articles with both a practical and research bent by the top thinkers in the field of security and privacy, along with case studies, surveys, tutorials, columns, and in-depth interviews and podcasts for the information security industry. Through special issues, the magazine explores other timely aspects of privacy in areas such as usable security, the Internet of Things, cloud computing, cryptography, and big data. Other popular topics include software, hardware, network, and systems security, privacy-enhancing technologies, data analytics for security and privacy, wireless/mobile and embedded security, security foundations, security economics, privacy policies, integrated design methods, sociotechnical aspects, and critical infrastructure. In addition, the magazine accepts peer-reviewed articles of wide interest under a general call, and also features regular columns on hot topics and interviews with luminaries in the field.