Typical severity: High. Likelihood of attack: Low. An attacker alters or establishes rogue processes in an integration facility in order to insert maliciously altered components into the system. The attacker would then supply the malicious components. This would allow for malicious disruption or additional compromise when the system is deployed.
Deploy strong code integrity policies to allow only authorized apps to run. | Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities. | Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and requiring multi-factor authentication for admins. | Require SSL for update channels and implement certificate transparency based verification. | Sign everything, including configuration files, XML files and packages.