OSC&R framework to stop supply chain attacks in the wild

A team of cyber security leaders and influencers have joined together to launch an open framework to help security teams improve their understanding of threats to their software supply chains, and evaluate and get to grips with them.

The Open Software Supply Chain Attack Reference, or OSC&R, is a MITRE ATT&CK-like framework created with input from the likes of Check Point, Fortinet, GitLab, Google, Microsoft, OWASP, and others, led by Ox Security, an Israel-based supply chain security specialist.

In light of the growing number of major cyber incidents that began via exploitation of vulnerabilities in software, whether closed or open source, the group believes there is a concrete need for a solid framework to let experts understand and measure their supply chain risk, which up to now, they say, could only really be done via a combination of intuition and lived experience.

“Trying to talk about supply chain security without a common understanding of what constitutes the software supply chain isn’t productive,” said Neatsun Ziv, a former Check Point vice-president, who founded Ox Security – which emerged from stealth in September 2022 backed by $34m of funding.

“Without an agreed-upon definition of the software supply chain, security strategies are often siloed,” he said.

OSC&R will supposedly help this by establishing a common language and structure to help security teams understand and analyse the tactics, techniques and procedures (TTPs) that threat actors use to compromise downstream victims via their software supply chains.

The framework, which is set out in more detail here, is already available and ready to be used to help teams evaluate their defences, define what threats they need to prioritise, understand how their existing security postures might address said threats, and to help track attacker behaviours.

Its backers hope to update it as new TTPs emerge and evolve, and eventually plan to have the framework assist red-teaming activities by helping set the scope of exercises, serving as a kind of scorecard during and after such testing. It is also open to other security practitioners to contribute to, should they wish.

“OSC&R helps security teams build their security strategy with confidence,” said Hiroki Suezawa, senior security engineer at Gitlab. “We wanted to give the security community a single point of reference to proactively assess their own strategies for securing their software supply chains and to compare solutions.”