MITRE ATT&CK

Supply Chain: compromise prevention, dependency compromise, trust subversion.


Short name	ATT&CK
Region	International
Country or scope	International
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ATT&CK

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for ATT&CK.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for ATT&CK and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ATTACK-T1195.002` Software Supply Chain Integrity	Defending against compromise of software delivered through the supply chain requires verifying artifact integrity, i.e. hashes for the components consumed (MITRE ATT&CK T1195.002, Compromise Software Supply Chain)	Scan
`ATTACK-T1195.001` Dependency and Tooling Visibility	Detecting compromise of development tools and dependencies requires documented dependency relationships across the build (MITRE ATT&CK T1195.001, Compromise Software Dependencies and Development Tools)	Scan
`ATTACK-M1051` Update Software	The Update Software mitigation requires knowing the current version of every component to determine patch status (MITRE ATT&CK mitigation M1051)	Scan
`ATTACK-M1016` Vulnerability Scanning Correlation	The Vulnerability Scanning mitigation depends on components being identifiable against vulnerability data via PURL or CPE (MITRE ATT&CK mitigation M1016)	Scan
`ATTACK-T1195-TRUST` Supplier Trust Assessment	Assessing which upstream parties could subvert trust requires a named supplier for each component in the chain (MITRE ATT&CK T1195, supply chain compromise vectors)	Scan
`ATTACK-INTEL-UID` Threat Intelligence Matching	Matching components against threat intelligence on compromised packages requires unique identifiers such as package URLs (MITRE ATT&CK T1195 detection guidance)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`T1195`	Detect and Prevent Supply Chain Compromise
`T1195.001`	Prevent Compromise of Software Dependencies
`T1195.002`	Prevent Compromise of Software Supply Chain
`T1195.003`	Mitigate Compromise of Hardware Supply Chain
`T1199`	Control Trusted Relationship Access
`T1078`	Detect and Prevent Valid Account Abuse
`T1190`	Harden Public-Facing Applications
`M1016`	Apply Vulnerability Scanning Mitigation
`M1051`	Update Software Mitigation
`M1045`	Enforce Code Signing Mitigation

Policy templates

Written for ATT&CK:

Supply Chain Threat Defense Policy (MITRE ATT&CK)
ATT&CK-Aligned Threat Detection and Response Policy

And 22 from the standard set, adapted to ATT&CK.