Risk Explorer for Software Supply Chains

This project offers a tool to explore a taxonomy of attack vectors targeting open-source software supply chains. This information has been compiled on the basis of numerous real-world incidents, i.e. actual attacks and vulnerabilities, as well as plausible proof-of-concepts and scientific literature. You can find more about this work in our paper. The project can be used as learning material for awareness campaigns or trainings, but also for purposes such as threat modeling, risk-assessments or pentest scoping. In more detail, project and tool provide the following information: * Attack Tree: a hierarchical organization of 100+ attack vectors and techniques comprised in the taxonomy, starting from the abstract, top-level goal down to alternative and more concrete attack techniques * Attack Vectors: a tabular view of all the attack vectors, along with the description, references, real-world examples and mapped safeguards * Safeguards: a tabular view of countermeasures that fully or partially mitigate the above-mentioned attacks * References: 300+ resources in some or another way related to supply chain security, both scientific and gray literature, all tagged and linked to attack vectors/safeguards Risk Explorer for Software Supply Chains is the open-source project SAP/risk-explorer-for-software-supply-chains (https://github.com/SAP/risk-explorer-for-software-supply-chains) by SAP, released under Apache-2.0. Ion packages it unmodified from commit 79e2a3946a24, adding only a manifest, an icon and a storage compatibility script.

Written by SAP, published to Oikou by Ben Grande.

• ★ 83 stars on GitHub
• Licence: Apache-2.0
• Built from commit 79e2a3946a24

View the repository on GitHub

Not rated. Nobody has said who this app is suitable for, so Personal Clouds and the Oikou app treat it as 18+.

Internet

It asks to reach these hosts, and no others:

• fonts.googleapis.com
• fonts.gstatic.com

Personal Cloud tools

None. It uses nothing from your Personal Cloud beyond its own storage.

Notifications

It does not send push notifications.

Storage

Up to 16 MB on your Personal Cloud.

Sign in to add this web app to a Personal Cloud of yours. It runs there, on your own computer, and you open it from there; nothing is installed on your phone.

Sign in to add