- Published
- Source
- AWS Security Blog
- Filed under
- Cloud
Software supply chain attacks have grown in both frequency and sophistication. Recent high-profile compromises of build systems and open source dependencies demonstrate that attackers increasingly target the trust mechanisms that verify software integrity. Those trust mechanisms rely on digital signature algorithms, and today many use traditional algorithms such as Rivest-Shamir-Adleman (RSA) and the Elliptic Curve…
Cloud checks worth doing
- Know every account and subscription you run – the forgotten ones are where exposures hide.
- Nothing public by default: storage, keys and admin consoles closed to the internet, and code scanned for secrets.
- Turn on the provider's audit logs, and alert on new access keys, policy changes and anything made public.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Supply Chain Compromise
Initial AccessWhat a defender checks
- Find where the affected package, update or vendor is used in your estate.
- Pin and verify dependencies, and keep a software bill of materials.
- Review what access the vendor's software has.
Build the skillBlue Team Engineer · Risk Assessment & Recommendations Reporting
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Engineer · Cloud Security Engineering
Most cloud breaches are configuration. Learn to get it right.
Blue Team Engineer covers CSPM at scale, CIS hardening, cloud-native detection and response, and mapping Azure controls to AWS and GCP – configured hands-on in your own tenants.
- CSPM and CIS hardening
- Cloud-native detection and response
- Azure, AWS and GCP
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
