CAS-005 · Question #236
An organization found a significant vulnerability associated with a commonly used package in a variety of operating systems. The organization develops a registry of software dependencies to…
The correct answer is A. Supply chain attack. An organization addresses a significant vulnerability in a common package by creating a registry of vetted package hashes to facilitate incident response.
Question
An organization found a significant vulnerability associated with a commonly used package in a variety of operating systems. The organization develops a registry of software dependencies to facilitate incident response activities. As part of the registry, the organization creates hashes of packages that have been formally vetted. Which of the following attack vectors does this registry address?
Options
- ASupply chain attack
- BCipher substitution attack
- CSide-channel analysis
- DOn-path attack
- EPass- the-hash attack
How the community answered
(35 responses)- A91% (32)
- B3% (1)
- C6% (2)
Why each option
An organization addresses a significant vulnerability in a common package by creating a registry of vetted package hashes to facilitate incident response.
A supply chain attack involves targeting software at any point in its delivery pipeline by injecting malicious code into legitimate packages. By hashing formally vetted packages, the organization can detect if a package has been tampered with or replaced with a malicious version, thereby addressing supply chain risks.
A cipher substitution attack involves replacing ciphertext with different ciphertext and is a cryptographic attack, unrelated to the integrity of software packages.
Side-channel analysis exploits information leaked from the physical implementation of cryptographic systems, such as power consumption, and is unrelated to software package integrity.
An on-path attack involves intercepting and potentially altering communication between two parties, which is not directly addressed by vetting software packages with hashes.
A pass-the-hash attack is a credential-theft technique that involves authenticating using a password hash, unrelated to software supply chain integrity.
Concept tested: Mitigating supply chain attacks
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/supply-chain-security
Community Discussion
No community discussion yet for this question.