CAPEC-444: Development Alteration
An adversary modifies a technology, product, or component during its development to acheive a negative impact once the system is deployed. The goal of the adversary is to modify the system in such a way that the negative impact can be leveraged when the system is later deployed. Development alteration attacks may include attacks that insert malicious logic into the system's software, modify or replace hardware components, and other attacks which negatively impact the system during development. These attacks generally require insider access to modify source code or to tamper with hardware components. The product is then delivered to the user where the negative impact can be leveraged at a later time.
Comment
We consider that this threat is about a malicious/compromised developer. We assume that reviewed code by another developer is a mitigation. Effectively the same as DZ-2-CODE.
Requirements and Mitigations
Requirements
Component properties that must be true for this threat to apply:
Mitigations
Component properties that mitigate this threat:
Affected Components
| Component | Description | Boundary |
|---|---|---|
| DZ App | Primary DZ application and interface, executed on the host machine | Local host |