一句话：系统映射三种供应链攻击技术与十框架缓解任务，识别优先级与缺口。
软件供应链安全框架虽列出推荐任务，但组织仍需了解哪些任务能缓解攻击者当前使用的技术，以便优先排序并弥合缺口。本文定性分析 SolarWinds、Log4j 和 XZ Utils 三起攻击的 106 份报告，提取攻击技术，再将其与 10 个供应链框架中的 73 项任务系统映射并排序。结果显示，得分最高的缓解任务是基于角色的访问控制、系统监控和边界保护；另有可持续开源软件、环境扫描工具等三项任务在所有框架中缺失。因此，即使组织采纳全部推荐任务，软件产品仍可能易受供应链攻击。
Software supply chain frameworks, such as the US NIST , detail what tasks software development organizations are recommended or mandated to adopt to reduce security risk. However, to further reduce the risk of similar attacks occurring, software organizations benefit from knowing what tasks mitigate attack techniques the attackers are currently using to address specific threats, prioritize tasks, and close mitigation gaps. The goal of this study is to aid software organizations in reducing the risk of software supply chain attacks by systematically synthesizing how framework tasks mitigate the attack techniques used in the SolarWinds (solarwinds), Log4j (log4j), and XZ Utils (xz) attacks. We qualitatively analyzed 106 reports of the 3 attacks to gather the attack techniques. We then systematically constructed a mapping between attack techniques and the 73 tasks enumerated in 10 software supply chain frameworks. Afterward, we established and ranked priority tasks that mitigate attack techniques. The three mitigation tasks with the highest scores are role-based access control, system monitoring, and boundary protection. Additionally, three mitigation tasks were missing from all ten frameworks, including sustainable open-source software and environmental scanning tools. Thus, software products would still be vulnerable to software supply chain attacks even if organizations adopted all recommended tasks.
@inproceedings{abs-2503-12192,
title = {Closing the Chain: How to reduce your risk of being SolarWinds, Log4j, or XZ Utils},
author = {Sivana Hamer and Jacob Bowen and Md Nazmul Haque and Robert Hines and Chris Madden and Laurie Williams},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773194}
}