Name: Deconstructing OneDrive & Dropbox: A Cloud Storage App Throwdown
Start: 2023-09-07T15:38:00Z
End: 2023-09-07T15:38:34.000Z
Location: BrightTALK
Rating: 0

ReversingLabs empowers modern software development & SOC teams to protect their software releases & organizations from sophisticated threats. 

In the modern enterprise, the tools used to evaluate complex software packages, identifying risks and threats, are more critical than ever. 

In this webinar, we will discuss the evolution of static analysis to binary analysis, highlighting this technology’s significance in threat analysis of complex software packages. 

This webinar aims to provide an understanding of the difference in the analysis technology, illustrating how static binary analysis is leveraged to bolster a software security posture and understand the security risks prior to deployment into organizations.

Key Learnings: 
✓ Introduction to software analysis techniques and their role in the software development lifecycle.
✓ The benefits of early software risk and threat detection, reduced remediation costs, and improved compliance.
✓ How legacy tools like SAST and SCA leave gaps in the software security posturing that require this level of analysis
✓ How ReversingLabs applies the technique to gain unparalleled visibility into complex software packages

Static vs Static Binary Analysis: The Future of Complex Code Deconstruction

See ReversingLabs’ latest features and get a sneak peek of what's coming next for customers.

Watch our host and Sr Dir., Product Marketing, Richard Melick, and VP of Product, Eirk Thoen, as they showcase our latest releases, take you through our platform improvements and new features, and highlight recent advancements to ReversingLabs complete product lineup.

In this quarterly webinar, you will learn:

✓  Exciting updates to our software supply chain security and malware analysis offerings

✓  Use cases on the best ways to use these features

✓  A sneak peak at some coming updates

Malware Analysis,Threat Hunting & Software Supply Chain Security Product Updates

Security teams struggle with alert fatigue caused by a variety of factors, which impacts the overall security posture of an enterprise. Too much time is wasted chasing false positives and investigating anomalies that turn out to be normal application behaviors. 

The information provided by software supply chain security during the normal application review process can aid security teams long term by helping tune alerts before software is deployed, or address specific concerns or risks with extra layers of detections as needed. 

This addition to the application review process can lead to significant resource savings, and increased network security.

Key episode takeaways: 

✓ Enterprise security team pain points related to detections and false positives

✓ Identifying behaviors likely to trigger host based security alerts

✓ Reviewing network traffic elements for inclusion in relevant allow lists across security applications and appliances

Reducing False Positives in the SOC with Software Anlaysis

Watch as ReversingLabs Software Threat Researcher Lucija Valentić digs into the recent string of software supply chain attacks targeting developers on PyPI and npm. 

Valentić will unpack the details of Brainleeches, VMConnect and Luna Grabber campaigns including the methods and malicious deliverables used by both sophisticated and unsophisticated actors to compromise development organizations. 

You won't want to miss these insights.

Threats Uncovered: Unpack the Latest PyPI and npm Supply Chain Attacks

In this episode, Matt explains why CISA's Secure by Design, Secure by Default policy is great in concept, but is actually difficult to execute in the real-world. This is because the policy can really only be applied to new software that hasn't been released yet to the market.

CISA Secure by Design/Secure by Default is HARD

From Black Hat to BSides to DEF CON, ReversingLabs gathered 3 top notch experts who were there and ready to share their perspectives. 

Watch this special post-Black Hat event for a post-mortem on the highs and lows of one of the biggest weeks in cybersecurity. Presenters will talk about takeaways from sessions attended, input on key trends at the shows and predictions for what’s next in cybersecurity. 

✓ Key findings at Black Hat about what’s next for our industry
✓ Insight into the biggest security revelations from the talks
✓ How enterprises can apply these lessons to stay safe
 
About the presenters: 

Derek Fisher is the author of Application Security Program Handbook: A guide for software engineers and team leaders and Head of Security at Envestnet. He is also an External Advisor on the Cyber DIA Advisory Board and Adjunct Professor Secure Software Development Temple University.

Freakyclown is the author How I Rob Banks: And Other Such Places and Co-Founder and Co-CEO of Cygenta. Additionally he is a well-known ethical hacker and social engineer. He has been working in the infosec field for over 20 years and excels at circumventing access controls.

Chris Hughes is the author of Software Transparency: Supply Chain Security in an Era of a Software-Driven Society and Co-Founder and CISO at Aquia. He has spent his career building a reputation as a proven Cloud/Cybersecurity leader with nearly 20 years of experience in Federal and commercial industries.

Black Hat...Now What? Tips & Takeaways From the Biggest Week In Cybersecurity.

In this episode of ReversingGlass, Matt makes the essential point that trust in your software supply chain is all or nothing. He explains that trusting anything less than 100% of the components in your software package will set your organization up for major risk. This is why trust in software supply chains needs to be complete, so that the risk of a software supply chain attack to your organization can be minimized.

Trust in Your Software Must be Complete

87% of companies have detected software issues in their software supply chain in the last 12 months, according to a recent survey.  A majority of respondents also said their organization’s software supply chain security was not as mature as it should be.[1] 

CI/CD environments are appealing targets for malicious actors intent on using your software delivery processes as their attack pipeline.  

Join Daniel Gallo, Solution Engineer, JetBrains -TeamCity and Igor Lasic, SVP Engineering, ReversingLabs, as they discuss approaches to overcome the challenges that DevSecOps teams face in defending their CI/CD environments against multiple attack vectors and threats.

Learn tips & tricks for delivering trustworthy software, including:

✓ Securing CI/CD infrastructure
✓ Creating secure software
✓ Validating security levels before shipping

TIPS FOR OVERCOMING THE TOP CHALLENGES IN DELIVERING TRUSTWORTHY SOFTWARE

In this episode, Matt explains why organizations need to strengthen their software supply chain security efforts immediately, given the increase in both the speed and complexity of development environments.

Why the time is NOW for Software Supply Chain Security

In this episode of ReversingGlass, Matt explains the key differences behind two major threats to software supply chains: vulnerabilities and malware. He demonstrates how vulnerabilities are unintentional risks, while malware is an intentionally nefarious action.

The Differences Between Vulnerabilities and Malware

In this episode, we will focus on code signing certificates, the role they play in software, and the many ways they can be abused. Understanding these elements will help us define and tune our baselines in that area.

Key episode takeaways: 

✓ The function of code signing certificates and how they work

✓ The risks of file tampering and how can it be detected

✓ Evaluating the risks of different certificate policies and adjusting the baseline to support specific needs or use cases.

Fine Tuning Your Risk Baseline With Code Signing Certificates

SolarWinds and the more recent 3CX attack put software supply chain security front and center for organizations. While they recognize risk is enterprise-wide, traditional app sec tools are not up to the job. Learn why modern tooling and a mature supply chain security program are now a requirement for managing software risk.

In ReversingLabs’ new Software Supply Chain Security Risk Report, Chris Wilder, Research Director at TAG Cyber and author of the report, will analyze the key findings from a Dimensional Research survey of more than 300 IT pros and Matt Rose, Field CISO at ReversingLabs, co-author of the report, will discuss the evolution of application security — and how a mature software supply chain security approach is now a requirement for managing risk. 

Key Webinar Learnings:

✓ The software supply chain pain points for modern development organizations
 
✓ How gaps in existing application security tooling leave development organizations and security teams exposed to supply chain attacks. 
 
✓ The limitations of narrowly scoped software supply chain initiatives and the need for comprehensive approaches to securing supply chains. 
 
✓ How organizations can operationalize software supply chain security and move beyond “checkbox” compliance, including using Software Bills of Materials (SBOMs) to provide a comprehensive overview of software risk and dependencies.

Why Modern Tooling is Now a Requirement for Full Software Supply Chain Security

There’s a lot of noise and confusion surrounding software supply chain security. What is it?  Does it really matter? How can it be operationalized? What can I do? 

In this episode, we’ll talk about creating a policy baseline and tuning it to suit an enterprise’s use cases, risk appetite, and areas of concern.

Key episode takeaways: 

✓ Understanding the main areas of supply chain security and the risk they may pose to your organization

✓ Creating a use-case focused policy to reduce noise and focus on the things that matter.

✓ Policy configurations aren’t one size fits all. Different teams, projects, or risk profiles may require their own custom policy set.

Supply Chain Analysis: Creating a Risk Assessment Baseline

In this episode of ReversingGlass, Matt explains how trust is foundational to software supply chain security. Software producers and consumers alike need to continually question whether or not the software they are making or buying is trustworthy.

Trust and Software Supply Chain Security

In this episode we will take a look at one of the most popular container related applications: Docker Desktop.

Container security involves more than containers... it encompasses the tools used to create and manage them. The tools used for any type of development, security or administration functions are often overlooked elements of an enterprise's attack surface.

Watch Tim Stahl, Director of Field Threat Engineering at ReversingLabs as he uses the ReversingLabs Software Supply Chain Security platform to identify these overlooked elements that pose risks to enterprises.

Deconstructing Docker Desktop Software Package

SBOMs (software bills of materials) have become an essential tool in securing software supply chains. But what’s the right way to use them? In this episode, Matt Rose explains how software publishers need to shift up their SBOMs, so that they showcase the entire threat landscape posed to software supply chains.

Shift Up Your SBOM

Recently, threat actors have been injecting malicious code into open source and software products which enterprises download and integrate into their systems, exposing them to malware.

These types of attacks are increasingly common, with software supply chain attacks rising by 742%. This increase is due to a greater dependence on open source packages with up to 90% of code in applications being open source, as well as outdated tooling and security practices, leaving enterprises vulnerable to new attack vectors.

In this webinar we will take a deep dive into how police departments and security teams assess emerging threats, where they traditionally fall short when developing investigation strategies, why and how open source components pose the greatest risk for organizations, and how to safely use foreign code with ReversingLabs Software Supply Chain Security platform.

Key Learnings:
✓  Latest trends in software supply chain attacks 

✓  How and why supply chain attacks occur

✓  Why open source packages are an easy target for supply chain attacks 

✓ How to find threats and secure open source components in your software using NIST-based ReversingLabs Software Supply Chain Security platform

Eliminating Threats Lurking In Open Source Packages

Enterprise applications performing similar functions can vary greatly from one vendor to another. Understanding those differences can help when choosing one to purchase or support, and enable an informed risk assessment. 

In this episode we will look at a few popular cloud storage applications, including OneDrive and Dropbox to see how they behave, how much bloat and risk they bring with them, and some interesting easter eggs hidden within the packages.

Key episode takeaway: 

✓ How to perform rapid repeatable comparison and risk assessment using the ReversingLabs Software Supply Chain Security platform

Deconstructing OneDrive & Dropbox: A Cloud Storage App Throwdown

Threat Intelligence

Cloud Security

Application Security

Security Analysis

DevSecOps

Risk Management

Risk Assessment

Data Security

Are you an IT service management professional interested in developing your knowledge and improving your job performance? Join the IT service management community to access the latest updates from industry experts. Learn and share insights related to IT service management (ITSM) including topics such as the service desk, service catalog, problem and incident management, ITIL v4 and more. Engage with industry experts on current best practices and participate in active discussions that address the needs and challenges of the ITSM community.

IT Service Management

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Deconstructing OneDrive & Dropbox: A Cloud Storage App Throwdown

Presented by

About this talk

More from this channel