Name: How To Keep Your Secrets SECRET!
Start: 2023-05-25T15:37:00Z
End: 2023-05-25T16:19:15.000Z
Location: BrightTALK
Rating: 0

ReversingLabs empowers modern software development & SOC teams to protect their software releases & organizations from sophisticated threats. 

In this episode, Matt answers a simple yet important question: Who is ReversingLabs? Matt does this by recalling the company’s history, dating back to 2009, which began with ReversingLabs hosting the world’s largest reputational database for malware. He then details ReversingLabs’ growth into a leading provider of software supply chain security.

Who is ReversingLabs?

The tools we use every day, especially common open source tools, tend to be an overlooked link in the software supply chain. Performing third party risk management (TPRM) analysis on these tools is crucial, as we saw with Log4J.  The good news is that assessing that risk (with a focus on behaviors and capabilities) can be done friction free with minimal effort.
 
Key areas of focus include:

✓ How to gain visibility into your extended attack surface from 3rd-party code repositories like GitHub

✓ How to assess software package expectations vs behaviors, and the use of common patterns to streamline analysis

✓  The benefit of conducting comprehensive network traffic assessment on the final executable package using static vs. dynamic analysis

Deconstructing and analyzing Tabby and Notepad ++ Software Packages

In this episode, Matt touches on the newfound popularity of AI in relation to Software Supply Chain Security, pointing out the concerns he has for this technology being used by both good and bad actors.

AI and Software Supply Chain Security: Proceed with Caution!

Nearly 9 in 10 companies have experienced software issues and exposures over the last 12 months. More than 6 in 10 companies believe their software supply chain security defenses are behind, resulting in 80% reporting their company is directly focusing on improving their supply chain security. 

These and many other illuminating insights were uncovered in the ReversingLabs Software Supply Chain Risk Survey, conducted by Dimensional Research as part of a global survey of over 300 security and IT professionals and executives. The survey contains critical findings that every cybersecurity expert should factor into their decision making for 2023 and beyond.  

ReversingLabs' Paul Roberts and Matt Stephenson present the findings of the ReversingLabs Software Supply Chain Risk Survey, where he will discuss the broader implications for companies's risk postures.

Top 7 Software Supply Chain Security Concerns Revealed

In this episode, Matt uses the analogy of America’s beloved boxed mac n’ cheese to define what a software bill of materials (SBOM) is and should be. He then points out that when making SBOMs, organizations should look to approved and standardized SBOM formats for them to be as clear and transparent as possible.

What the heck is an SBOM

In this first episode the 3CX software package and recent supply chain attack is analyzed using the ReversingLabs Software Supply Chain Security Platform. We will deconstruct the 3CX software package, highlights critical red flags, and shows how you can apply these processes to your own secure build process.

Deconstructing the 3CX Software Package

In this episode, Matt touches on real-life software supply chain security cases such as the recent 3CX hack, and how popular media from past and present both imitates and forewarns this kind of threat.

Supply Chain Risks in Art and Life...even the "Simpsons"

In this episode of ReversingGlass, Matt Rose explains what's included in the CISA's new initiative: Secure by Design, Secure by Default. He points out that while it's a good starting point for companies to refer to, it shouldn't serve as the end point for practicing software supply chain security.

Why CISA Secure by Design is Just a Starting Point

Eighty-plus percent of surveyed companies believe traditional SAST, DAST, & SCA technology don't fully protect them from software supply chain threats. This session discusses the reasons these analyses alone cannot provide effective risk management and breach response.

Why Traditional App Sec Tools Fail at Software Supply Chain Security

n this episode, Matt quantifies the various use cases surrounding software supply chain security (SSCS): Home-grown apps, third-party risk management (TPRM), mergers and acquisitions, and cybersecurity insurance.

Software Supply Chain Security Use Cases

In this episode, Matt quantifies the various use cases surrounding software supply chain security (SSCS): Home-grown apps, third-party risk management (TPRM), mergers and acquisitions, and cybersecurity insurance.

Software Supply Chain Security (SSCS) Use Cases

ReversingLabs Co-Founder/Chief Software Architect Tomislav Pericin and Field CISO Matt Rose delve into the details of the explosive software supply chain attack experienced by 3CX, a provider of enterprise voice over IP (VOIP) solutions. Beginning on March 22nd, 2023, it was discovered that 3CX had released and distributed malware-compromised versions of its 3CXDesktopApp desktop VoIP client directly to customers.

While the industry is experiencing the ripple effect of this security incident, early indicators point strongly to a compromise of 3CX’s software build pipeline, leading to malicious code being inserted into the 3CXDesktopApp package.

Tomislav & Matt cover the critical details resulting from analysis of the malicious files used in the attack and explore what pre-emptive actions could have been taken by 3CX to prevent this hack and mitigate future attacks following similar patterns.

In this webinar, you will learn:

✓  The initial impact of the 3CX software supply chain attack

✓  Where legacy tools and policies failed to detect and address the risks in its software package

✓  Who is responsible for this attack and what it means for software development as a whole

✓  How 3CX and others can detect and mitigate these increasingly advanced software supply chain threats

What you need to know about the 3CX Cyber Attack

In this episode, Matt lists and explains the various areas of the software supply chain that need to be covered with a modern security solution. He points out that just looking at the build system or open source software alone for threats will not provide full software supply chain security (SSCS) coverage.

Full-Coverage Software Supply Chain Security Explained

In this episode of ReversingGlass, Matt defines software supply chain security by pointing out the different links that the chain comprises. Each link covers different threats, but each is connected to the creation of a complete software artifact, making comprehensive coverage of the software supply chain a must.

How to Define Software Supply Chain Security

In this episode, Matt specifies what “good” software supply chain security (SSCS) looks like. By pointing out all of the pieces to the complex puzzle that is SSCS, Matt showcases that you need an SSCS solution that is comprehensive enough to cover all of these parts, but is smart enough to best serve busy development and SOC teams.

Get Smart With Your Software Supply Chain Security

In the wake of a series of high-profile breaches, it’s become apparent just how vulnerable software
supply chains really are. But where, exactly, are the most critical vulnerabilities? And what does
effective software supply chain security actually look like?

This session explores where security pros fit in the application development puzzle, the trends
impacting this relationship, and best practices for securing the software supply chain. Topics covered
inside include:

• Different vendors, different definitions: What is software supply chain security?
• Known vs. unknown vulnerabilities and where you should focus your efforts
• RIP shift left: Where do we go from here?
• And more

Top vulnerabilities in the software supply chain: Which are most critical?

In this episode of ReversingGlass, Matt visually explains the components and processes of a software supply chain, from the development process all the way to the continuous delivery of a software package. He then points out the various opportunities attackers can take to compromise a supply chain.

The DNA of Software Supply Chain Security

Secrets hardcoded or exposed in software release packages or containers (whether by accident or intentionally) is a challenge all development teams face – and a boon for cybercriminals with automated means to find them to gain access for supply chain attacks.

Learn which secure software development best practices to put in place today to stop attacks from happening tomorrow.

How To Keep Your Secrets SECRET!

Software Security

Application Delivery

Application Security

DevOps

Breach Detection

Breach Prevention

Cyber Attacks

Cyber Security

Software Development

Are you an IT service management professional interested in developing your knowledge and improving your job performance? Join the IT service management community to access the latest updates from industry experts. Learn and share insights related to IT service management (ITSM) including topics such as the service desk, service catalog, problem and incident management, ITIL v4 and more. Engage with industry experts on current best practices and participate in active discussions that address the needs and challenges of the ITSM community.

IT Service Management

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

How To Keep Your Secrets SECRET!

Presented by

About this talk

More from this channel