Abstract:

At present, software supply chain security incidents occur frequently, and conducting security risk assessments can identify potential risks. This is an important method to manage security risks and prevent security incidents. As the core foundational software of information systems, the mixed source operating system (MSOS) is widely used in the government, power, finance, communication and other important fields, and its supply chain should be paid more attention to. Due to the diverse code sources, large code scale, and complex structure and component dependencies of MSOS, existing software supply chain security risk assessment methods are not fully applicable to MSOS in terms of ensuring goals and indicator systems. To address this issue, the article proposed traceability, availability and security assurance objectives for supply chain security. Based on these assurance objectives, risk factors affecting the supply chain security of MSOS was analyzed, and a measurable indicator system was designed to evaluate its security risk. The effectiveness of the indicator system was verified through examples, and some relevant technical means and tools that can be used to evaluate important indicators were summarized and elaborated.

Key words: mixed source, operating system, security of supply chain, risk factors