CAPEC 677 Server Motherboard Compromise

Draft Detailed Low Risk

Severity High

Description

{'xhtml:p': 'Malware is inserted in a server motherboard (e.g., in the flash memory) in order to alter server functionality from that intended. The development environment or hardware/software support activity environment is susceptible to an adversary inserting malicious software into hardware components during development or update.'}

Mitigations

Purchase It Systems, Components And Parts From Government Approved Vendors Whenever Possible.

Conduct Rigorous Threat Assessments Of Suppliers.

Utilize Contract Language Requiring Contractors And Subcontractors To Flow Down To Subcontractors And Suppliers Scrm And Scra (Supply Chain Risk Assessment) Requirements.

CAPEC 677 Server Motherboard Compromise

Description

Mitigations

Purchase It Systems, Components And Parts From Government Approved Vendors Whenever Possible.

Conduct Rigorous Threat Assessments Of Suppliers.

Utilize Contract Language Requiring Contractors And Subcontractors To Flow Down To Subcontractors And Suppliers Scrm And Scra (Supply Chain Risk Assessment) Requirements.

Require That Bills Of Material (Bom) For Critical Parts And Components Be Certified.

Establish Trusted Supplier Networks.

Establish Diversity Among Suppliers.

Consequences

Security Scopes Affected

Potential Impacts

Relationships

Parent CAPECs

Related ATT&CK Techniques

Compromise Hardware Supply Chain

CAPEC 677 Server Motherboard Compromise

Description

Mitigations

Purchase It Systems, Components And Parts From Government Approved Vendors Whenever Possible.

Conduct Rigorous Threat Assessments Of Suppliers.

Utilize Contract Language Requiring Contractors And Subcontractors To Flow Down To Subcontractors And Suppliers Scrm And Scra (Supply Chain Risk Assessment) Requirements.

Require That Bills Of Material (Bom) For Critical Parts And Components Be Certified.

Establish Trusted Supplier Networks.

Establish Diversity Among Suppliers.

Consequences

Security Scopes Affected

Potential Impacts

Relationships

Parent CAPECs

Related ATT&CK Techniques

Compromise Hardware Supply Chain

Iscriviti alla newsletter