A Socio-technical Framework for Threat Modeling a Software Supply Chain
Bilal Al Sabbagh, Stewart James Kowalski · IEEE Security & Privacy · 2015
A new framework performs security threat modeling for a global software supply chain. The threat modeling is based on a case study from the Swedish Armed Forces. After a review of current practices and theories for threat modeling of a software supply chain, the authors suggest a socio-technical framework for studying the software supply chain security problem from a systemic viewpoint. The framework addresses issues of modeling the target system, identifying threats, and analyzing countermeasures.