# A Taxonomy for Threat Actors' Delivery Techniques
## 5 Our Proposal
### A Practical Example  
In this section we provide a practical example for our proposed taxonomy and its usefulness. For this case study, we have chosen the supply chain compromise delivery technique. As we have previously stated, supply chain compromise is a growing trend in advanced hostile operations; thus, it is mandatory to design and implement security countermeasures to face this technique. In order to protect an organization against supply chain techniques, the first step is to understand how they are implemented by threat actors. MITRE ATT&CK being the main framework for tactics and techniques, it is the first reference to analyze supply chain compromises. As we have stated, this framework provides three sub-techniques, two of them regarding software supply chain compromises and the last one regarding hardware supply chain compromises. With a main focus on software-related compromises, hardware supply chain attacks are in the background. This is consistent with an in-depth literature review, where most research is focusing nowadays on software supply chain attacks, that is, on the compromise of the software delivered to the target, both commercial [73] and open source [74]. On the other hand, hardware supply chain is, in general terms, less considered. The hardware supply chain security is analyzed and modeled in [75]. Hardware implants in supply chain attacks are analyzed in works such as [76], where the authors focus on the security of electronic devices, or [77], where [PERSON] et al. provide a review of Printed Circuit Boards' malicious hardware implants through the supply chain. This initial literature review, whose aim is to identify the security countermeasures to be implemented in order to protect an organization, presents two main problems that can lead organizations to leave relevant security gaps that can be exploited by advanced threats. The first problem is related to the focus on software supply chain attacks. These compromises are the more common ones, as hardware compromises usually require much more effort, human and economic, and their scope is limited to a reduced group of targets. Different Advanced Persistent Threat groups, such as APT29 or Sandworm, are able to compromise the software supply chain, while the groups with hardware compromise capabilities are less common. However, hardware supply chain compromises are still a relevant threat to organizations; thus, they must be conveniently considered when designing and implementing a protection plan. The second problem is related to the hardware versus software approach. This distinction is too simple in some cases and it usually refers to the way an artifact is delivered to the target, without considering other elements. In our proposed taxonomy, it focuses only on the delivery path. By adopting this simple hardware or software consideration, without evaluating other elements of the compromise, relevant protection gaps can be left by a security team. To face these common problems, our proposed taxonomy helps defensive teams to cover security gaps by considering uncommon delivery approaches. In addition, our taxonomy also allows the identification of novel techniques, in order to evaluate their likelihood and impact and, if applicable, to establish countermeasures to face them. Regarding supply chain compromises as a delivery technique, our taxonomy considers not only the delivery path point of view, but also the vector and the object. If we map supply chain related techniques onto our proposed taxonomy, both the ones defined in MITRE ATT&CK and unusual techniques identified in the literature review, we can find gaps that can lead to security breaches through a supply chain compromise. In relation to the Path, as we have stated, supply chain techniques are mostly linked to software and hardware delivery, not considering situations such as:  
* The mix of both approaches: the delivery of trojanized software through physical means, for example, through any removable media.