The website pbom.dev published their OSC&R matrix. OX Security launched the framework earlier this month with a founding group that includes security people from GitLab, FICO and Kaltura and a former Fortinet CISO, and pitches it for evaluating existing defenses and scoping red team exercises. Like MITRE ATT&CK, OSC&R is organized into a clear and structured view of the tactics, techniques, and procedures (TTPs) used by adversaries. However, OSC&R is the first and only matrix that focuses specifically on the software supply chain attacks. It covers a wide range of attack vectors, including vulnerabilities in third-party libraries and components, supply chain attacks on build and deployment systems, and compromised or malicious software updates.
PBOM stands for pipeline bill of materials. This is related to a software bill of materials (SBOM), which lists the components used to build software. Furthermore, PBOMs also include the build pipeline from design to production.