A Supply Chain Incident Taxonomy
Academia and government organizations have created multiple taxonomies to help classify attacks against open-source projects and supplier development processes. Unfortunately, from the asset owner’s perspective, these provide little useful insight: why should the OT operator care whether the supplier’s development processes were compromised via a malware infection versus social engineering? What really matters is how the offending software is introduced into the end user’s environment so it can be detected quickly and neutralized effectively.
Eric Byres proposes a Supply Chain Incident Taxonomy designed to assist the asset owner with understanding and responding to supply chain events.