OSC&R

OSC&R :

Open Software supply Chain attack Reference

---

[...] is an open framework that provides a comprehensive, systematic and actionable way to understand attacker behaviors and techniques. Like MITRE ATT&CK, OSC&R is organized into a clear and structured view of the tactics, techniques, and procedures (TTPs) used by adversaries. However, OSC&R is the first and only matrix that focuses specifically on the software supply chain attacks. It covers a wide range of attack vectors, including vulnerabilities in third-party libraries and components, supply chain attacks on build and deployment systems, and compromised or malicious software updates. https://pbom.dev/