Wiz Introduces SITF, a Framework for Mapping SDLC Infrastructure Threats
Summary
Wiz introduces SITF, an open framework for modeling attacks across SDLC infrastructure. It maps techniques to risks and controls, and demonstrates the approach with a Shai-Hulud 2.0 attack-flow analysis.
Key points
- SITF covers five SDLC infrastructure areas: Endpoint/IDE, VCS, CI/CD, Registry, and Production.
- The framework catalogs more than 70 techniques and links each to associated risks and controls.
- Its visualizer lets users map attack paths across systems and generates a prioritized controls matrix.
- A Shai-Hulud 2.0 example maps a multi-step attack involving a malicious pull request, CI/CD secrets, poisoned packages, endpoint malware, and persistence.
- The article recommends controls including approval for forked pull requests, branch protection, and workflow misconfiguration scanning.
- SITF is described as open-source and client-side, with tools to explore techniques, model flows, and export results. The article says no data leaves the user's machine.
Article Details
- Topic
- SITF, an open framework for modeling threats and controls across software development lifecycle infrastructure