Published: 25 April 2024
软件供应链攻击呈三位数增长，但很少有企业机构采取措施对这些复杂攻击的风险进行评估。安全和风险管理领导者可参考本文，采用三种实践来检测和预防攻击，保护企业机构的安全。
虽然软件供应链攻击频繁发生，但其安全评估尚未被纳入供应商风险管理或采购活动框架，导致企业机构易遭受攻击。
安全团队在应对漏洞时困难重重，尤其是在软件依赖项中包含漏洞的情况下。长期以来，软件组件并不对外披露，因此其内容往往并不透明。这使得安全团队难以确定软件是否已受到攻击的影响，需要投入大量的工作，才能识别受影响的软件并实施风险缓解措施。
客户很少对商业软件的潜在漏洞或恶意代码进行正式测试和评估，即使对于支持高价值或敏感流程的系统也是如此。这会留出横向移动路径，为恶意代码入侵提供了可乘之机，进而导致数据和知识产权失窃。
安全和风险管理（SRM）领导者已获得了解决内部应用开发中供应链问题的专业知识，可以利用这些知识，帮助企业机构开展以下三个方面的工作：
将软件供应链风险纳入供应商风险管理工作，并向负责软件采购的同事阐述供应链漏洞攻击的风险。这一策略旨在消除或减少对那些应用安全实践不够完善的供应商的依赖。
要求供应商提供其应用安全实践情况，及其所提供软件的组成和内容信息。此举便于开展供应商风险评估，并简化漏洞响应和缓解措施。
对支持高价值或敏感系统的软件进行专门测试和安全评估。测试范围应覆盖传统的软件漏洞检查以及恶意代码识别。
Clients can log in to view the entire document.
Analysts:
Dale Gardner
Gartner research, which includes in-depth proprietary studies, peer and industry best practices, trend analysis and quantitative modeling, enables us to offer innovative approaches that can help you drive stronger, more sustainable business performance.
Our independence as a research firm enables our experts to provide unbiased advice you can trust.
Not only is Gartner research unbiased, it also contains key take-aways and recommendations for impactful next steps.
Our research practices and procedures distill large volumes of data into clear, precise recommendations.
We provide actionable, objective insight to help organizations make smarter, faster decisions to stay ahead of disruption and accelerate growth.
We offer one-on-one guidance tailored to your mission-critical priorities.
We work with you to select the best-fit providers and tools, so you avoid the costly repercussions of a poor decision.
Connect directly with peers to discuss common issues and initiatives and accelerate, validate and solidify your strategy.
Gartner clients can log in to access the full library.
Attend a Conference
Experience Information Technology conferences
With exclusive insights from Gartner experts on the latest trends, sessions curated for your role and unmatched peer networking, Gartner conferences help you accelerate your priorities.
Gartner CIO & IT Executive Conference
São Paulo, Brasil
© 2026 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliates. This publication may not be reproduced or distributed in any form without Gartner's prior written permission. It consists of the opinions of Gartner's business and technology insights organization, which should not be construed as statements of fact. While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner business and technology insights may address legal and financial issues, Gartner does not provide legal or investment advice and its insights should not be construed or used as such. Your access and use of this publication are governed by Gartner’s Usage Policy. Gartner prides itself on its reputation for independence and objectivity. Its insights are produced independently by its business and technology insights organization without input or influence from any third party. For further information, see Guiding Principles on Independence and Objectivity. Gartner publications and other content may not be used as input into or for the training or development of generative artificial intelligence, machine learning, algorithms, software or related technologies.
