CWE-1357Reliance on Insufficiently Trustworthy Component

Description

Common consequences· 1

• Other — Reduce Maintainability

Potential mitigations· 3

• [Requirements, Architecture and Design, Implementation]For each component, ensure that its supply chain is well-controlled with sub-tier suppliers using best practices. For third-party software components such as libraries, ensure that they are developed and actively maintained by reputable vendors.
• [Architecture and Design, Implementation, Integration, Manufacturing]Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
• [Operation, Patching and Maintenance]Continue to monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, supplier practices that affect trustworthiness, etc.

(incoming)1

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.