A03 — Software Supply Chain Failures
Modern applications depend on many external components, such as open-source libraries, packages, frameworks, APIs, container images, and CI/CD tools.
Software Supply Chain Failures occur when these components or the processes used to build and deliver software are compromised or poorly secured.
Examples include:
Using compromised or malicious dependencies
Untrusted third-party packages
Outdated or vulnerable components
Compromised CI/CD pipelines
Insecure software updates
A vulnerability in a third-party dependency can potentially affect every application that depends on it.
Secure your application dependencies and the entire software development lifecycle—not just your own source code.
A04 — Cryptographic Failures
Cryptographic Failures occur when sensitive information is not properly protected using cryptography.
Examples include:
Storing passwords in plaintext
Using weak or outdated cryptographic algorithms
Poor encryption key management
Transmitting sensitive data without adequate protection
Using improperly configured encryption
Passwords should instead be securely hashed using an appropriate password-hashing algorithm.
Cryptography is only effective when the algorithms, keys, implementation, and configuration are handled correctly.
Top comments (0)