Podcasts about materials sbom

Play Episode Listen Later Aug 20, 2024 37:22

Guest: Chris Hughes, President / Co-Founder, AquiaOn LinkedIn | https://www.linkedin.com/in/resilientcyber/____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/sean-martinView This Show's Sponsors___________________________Episode NotesIn this episode of The Redefining CyberSecurity Podcast, host Sean Martin connects with Chris Hughes, a seasoned author and consultant in cybersecurity. The primary focus is on the intricacies of vulnerability management and software supply chain security, particularly in an era where software pervades every aspect of modern life.Chris Hughes emphasizes the paramount importance of understanding what is in the software we consume. Software Bill of Materials (SBOM) has emerged as a focal point, akin to ingredient lists in the food industry, highlighting the need for transparency. Hughes argues that transparency is not just about knowing the components; it extends to understanding the risks associated with those components. He illustrates his point by referencing infamous incidents like the Log4j vulnerability, which unveiled the critical gaps in our knowledge of software components.The conversation also shifts towards the broader challenges in software supply chain security. Hughes discusses the government's push for self-attestation and the role of third-party validators in ensuring software security. While acknowledging the complexities and potential bottlenecks, he underscores the necessity for a balanced approach that combines self-attestation with external validation to foster a secure software ecosystem.Additionally, Hughes addresses the concept of Secure by Design, advocating for practices that embed security into the software development lifecycle right from the outset. He notes the historical context of this concept, which dates back to the Ware Report, and argues for its relevance even today. Secure by Design entails building security measures inherently into products, thereby reducing the need for perpetual patching and vulnerability management.Internal risk management within organizations also gets spotlighted. Hughes insists that organizations should maintain an inventory of the software and components they use internally, evaluate their risks, and contribute to the open-source communities they rely on. This comprehensive approach not only helps in mitigating risks but also fosters a resilient and sustainable software ecosystem.On the topic of platform engineering, Hughes shares his insights on its potential to streamline software development processes and enhance security through standardization and governance. However, he is candid about the challenges, particularly the need to balance standardization with the diverse preferences of development teams.As the discussion wraps up, Hughes and Martin underline the importance of focusing on contextual risk assessment in vulnerability management, rather than merely responding to static severity scores. Hughes' advocacy for a more nuanced approach to security, balancing immediate risk mitigation with longer-term strategic planning, offers listeners a thoughtful perspective on managing cybersecurity challenges.Top Questions AddressedHow can organizations ensure transparency and security in their software supply chains?What strategies can be implemented to address the challenges of vulnerability management?How can platform engineering and internal governance improve software security within organizations?___________________________SponsorsImperva: https://itspm.ag/imperva277117988LevelBlue: https://itspm.ag/attcybersecurity-3jdk3___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

Building Resilient Software: Secure by Design, Transparency, and Governance Remain Key Elements | A Conversation with Chris Hughes | Redefining CyberSecurity with Sean Martin

Der Industrie Podcast des VDMA

Play Episode Listen Later Aug 20, 2024 37:22

Guest: Chris Hughes, President / Co-Founder, AquiaOn LinkedIn | https://www.linkedin.com/in/resilientcyber/____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/sean-martinView This Show's Sponsors___________________________Episode NotesIn this episode of The Redefining CyberSecurity Podcast, host Sean Martin connects with Chris Hughes, a seasoned author and consultant in cybersecurity. The primary focus is on the intricacies of vulnerability management and software supply chain security, particularly in an era where software pervades every aspect of modern life.Chris Hughes emphasizes the paramount importance of understanding what is in the software we consume. Software Bill of Materials (SBOM) has emerged as a focal point, akin to ingredient lists in the food industry, highlighting the need for transparency. Hughes argues that transparency is not just about knowing the components; it extends to understanding the risks associated with those components. He illustrates his point by referencing infamous incidents like the Log4j vulnerability, which unveiled the critical gaps in our knowledge of software components.The conversation also shifts towards the broader challenges in software supply chain security. Hughes discusses the government's push for self-attestation and the role of third-party validators in ensuring software security. While acknowledging the complexities and potential bottlenecks, he underscores the necessity for a balanced approach that combines self-attestation with external validation to foster a secure software ecosystem.Additionally, Hughes addresses the concept of Secure by Design, advocating for practices that embed security into the software development lifecycle right from the outset. He notes the historical context of this concept, which dates back to the Ware Report, and argues for its relevance even today. Secure by Design entails building security measures inherently into products, thereby reducing the need for perpetual patching and vulnerability management.Internal risk management within organizations also gets spotlighted. Hughes insists that organizations should maintain an inventory of the software and components they use internally, evaluate their risks, and contribute to the open-source communities they rely on. This comprehensive approach not only helps in mitigating risks but also fosters a resilient and sustainable software ecosystem.On the topic of platform engineering, Hughes shares his insights on its potential to streamline software development processes and enhance security through standardization and governance. However, he is candid about the challenges, particularly the need to balance standardization with the diverse preferences of development teams.As the discussion wraps up, Hughes and Martin underline the importance of focusing on contextual risk assessment in vulnerability management, rather than merely responding to static severity scores. Hughes' advocacy for a more nuanced approach to security, balancing immediate risk mitigation with longer-term strategic planning, offers listeners a thoughtful perspective on managing cybersecurity challenges.Top Questions AddressedHow can organizations ensure transparency and security in their software supply chains?What strategies can be implemented to address the challenges of vulnerability management?How can platform engineering and internal governance improve software security within organizations?___________________________SponsorsImperva: https://itspm.ag/imperva277117988LevelBlue: https://itspm.ag/attcybersecurity-3jdk3___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

SBOM: Die Zutatenliste für Softwareanwendungen

Play Episode Listen Later Aug 12, 2024 20:38

Mit dem Inkrafttreten des Cyber Resilience Act 2027 wird die Software Bill of Materials (SBOM) für Unternehmen verpflichtend. Die SBOM ist ein detailliertes Inventar aller Bestandteile einer Softwareanwendung und ermöglicht einen lückenlosen Überblick über die eingesetzten Komponenten. Der VDMA empfiehlt Unternehmen, sich frühzeitig vorzubereiten, um digitale Produkte weiterhin erfolgreich verkaufen zu können. In der neuesten Folge des VDMA Industrie Podcasts spricht Tobias Pfeiffer, Product Security Officer bei Festo, über die Chancen und Herausforderungen der Einführung einer SBOM. Maximilian Moser, Referent Industrial Security, Product Security, OT-Security des VDMA, betont die Notwendigkeit, kleine und mittelständische Unternehmen zu unterstützen. Der VDMA bietet seinen Mitgliedsunternehmen zahlreiche Angebote, insbesondere durch den Arbeitskreis Industrial Security. Bereiten Sie sich rechtzeitig auf den Cyber Resilience Act 2027 vor und nutzen Sie die Vorteile der SBOM für Ihr Unternehmen! Produktion: New Media Art Pictures

Episode 58: Discovering AIBOM and the Future of SBOM with Joseph Silvia

Automating Quality

Play Episode Listen Later Aug 6, 2024 15:12

Welcome to Automating Quality, the life sciences-centric show that bridges the gap between automation and quality management systems. This episode is the second in a two-part series discussing the Software Bill of Materials (SBOM) with guest Joseph Silvia. In this episode, we discuss the definition of AIBOM, how it differs from SBOM, and take an educated guess at their future. Joseph is the CEO of MedWareCyber, a consulting firm specializing in FDA readiness, cybersecurity, and software readiness for the medical devices industry. He is extremely knowledgeable about the regulatory landscape, and we frequently refer to him for his regulatory expertise. Key Takeaways; 01:05 Introducing guest Joseph Silvia 02:20 What is the concept of AIBOM? 04:23 Why AIBOM and SBOM should be separate discussions 07:45 How does open-source software impact those bills of material 11:22 How do you assess the risk of an AIBOM? Contact us at solabs-podcast@solabs.com

ceo discovering fda compliance key takeaways life sciences sbom materials sbom

SBOM Lifecycle Management for Mission-Critical Technology | Business Ninjas: WriteForMe & Vigilant Ops

Business Ninjas

Play Episode Listen Later Jul 15, 2024 20:50

Welcome to another episode of the Business Ninjas Podcast, where we uncover the strategies and stories behind successful business leaders. In this episode, we're thrilled to have Ken Zalevsky, the dynamic CEO of Vigilant Ops, join us for an in-depth conversation.Ken Zalevsky has been at the forefront of cybersecurity innovation, leading Vigilant Ops with a vision to protect businesses from the ever-evolving threats in the digital world. With his extensive experience and insights, Ken shares how Vigilant Ops is revolutionizing the cybersecurity landscape and providing robust solutions to safeguard sensitive data.**In this episode, we cover:**- The Importance of Software Bill of Materials (SBOM) in Cybersecurity- AI-Powered Email Scams- Maximizing Security in Software Development- How to Protect Against Phishing Attacks- Decoding Software Vulnerabilities- How Vigilant Ops Stays Ahead of Cyber Threats, and moreJoin us for an engaging and informative discussion that offers valuable takeaways for entrepreneurs, business leaders, and anyone interested in cybersecurity.

ceo ninjas cybersecurity vigilant cyber threats mission critical sbom lifecycle management technology business more join materials sbom

Episode 57: Introduction to the Software Bill of Materials with Joseph Silvia

Automating Quality

Play Episode Listen Later Jul 9, 2024 16:36

Welcome to Automating Quality, the life sciences-centric show that bridges the gap between automation and quality management systems. This episode is the first in a two-part series discussing the Software Bill of Materials (SBOM) with guest Joseph Silvia. We explore the history of SBOM, its current importance for the FDA, and how to ensure you have an SBOM in place when implementing or developing medical devices. "Joseph is the CEO of MedWareCyber, a consulting firm specializing in FDA readiness, cybersecurity, and software readiness for the medical devices industry. He is extremely knowledgeable about the regulatory landscape, and we frequently refer to him for his regulatory expertise. Key Takeaways 01:10 Introducing today's guest: Joseph Silvia 02:35 What is an SBOM? 04:24 What is the history of SBOM? 05:50 Now, the government is getting involved and SBOM is picking up steam. 06;35 What is the FDA's expectation on this topic for the medical devices industry? 09:03 When implementing or developing a device, how do you ensure that you have an SBOM in place to support it? 11:38 Who is responsible for SBOM within organizations? 14:37 Where can listeners learn more about this topic? Reach Joseph at jsilvia@medwarecyber.com Contact us at solabs-podcast@solabs.com

ceo software fda key takeaways materials sbom materials sbom

Dr. Georgianna, Chief Technologist at Foundation for Defensive Democracies, Advancing National Cybersecurity Through Innovation and Policy.

The Security Podcast of Silicon Valley

Play Episode Listen Later Jun 29, 2024 56:50

In this episode of The Security Podcast of Silicon Valley, host Jon McLachlan sits down with Dr. Georgianna Shea, the Chief Engineer at MITRE and Chief Technologist at the Foundation for Defense of Democracies. Dr. Shea shares her extensive experience in cybersecurity, from her work with the Department of Defense to her current role in influencing national security policy. Discover her insights on the importance of resilience in cybersecurity, the significance of Software Bill of Materials (SBOM), and how AI and quantum computing are shaping the future of cyber defense. Tune in for an inspiring conversation with one of the industry's leading experts.

ai discover innovation foundation defense silicon valley policy defensive advancing technologists democracies mitre chief engineer chief technologist security podcast national cybersecurity materials sbom

PP020: Dropping the SBOM: The Software Bill of Materials and Risk Management

Packet Pushers - Full Podcast Feed

Play Episode Listen Later Jun 25, 2024 35:29

If you care about nutrition, you check the ingredients of your food. If you care about your IT infrastructure, you check the Software Bill of Materials (SBOM) of the tech. At least that's the future that Thomas Pace hopes for. Right now, SBOMs aren't super common and software transparency is very low. Thomas walks us... Read more »

security networking software engineers cybersecurity dropping compliance materials risk management sbom sboms materials sbom thomas pace

PP020: Dropping the SBOM: The Software Bill of Materials and Risk Management

Packet Pushers - Fat Pipe

Play Episode Listen Later Jun 25, 2024 35:29

If you care about nutrition, you check the ingredients of your food. If you care about your IT infrastructure, you check the Software Bill of Materials (SBOM) of the tech. At least that's the future that Thomas Pace hopes for. Right now, SBOMs aren't super common and software transparency is very low. Thomas walks us... Read more »

security networking software engineers cybersecurity dropping compliance materials risk management sbom sboms materials sbom thomas pace

Redefining Cybersecurity by Unlocking Government and Startup Collaboration While Enhancing Software Supply Chain Visibility | A Conversation with Melissa Oh and Anil John | Redefining CyberSecurity with Sean Martin

Play Episode Listen Later May 6, 2024 33:00

Guests: Melissa Oh, Managing Director, Silicon Valley Innovation Program (SVIP), DHS Science & Technology Directorate [@DHSgov]On LinkedIn | https://www.linkedin.com/in/melissa-oh/Anil John, Technical Director, Silicon Valley Innovation Program (SVIP), DHS Science & Technology Directorate [@DHSgov]On LinkedIn | https://www.linkedin.com/in/aniljohn/On Twitter | https://twitter.com/aniltj____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/sean-martinView This Show's Sponsors___________________________Episode NotesThis new episode of the 'Redefining Cybersecurity' podcast features a thought-provoking discussion on software development, supply chain security, and the innovative initiatives of the Silicon Valley Innovation Program (SVIP). The conversation was led by host Sean Martin, with insights from distinguished guests Melissa Oh, Managing Director at the Department of Homeland Security Science and Technology Directorate, and Anil John, Technical Director of the Silicon Valley Innovation Program.Melissa Oh shared her extensive experience in public service and the innovative approach of the Silicon Valley Innovation Program in identifying emerging technology companies. Her background in Silicon Valley and dedication to solving DHS's pain points through collaboration with startups underscored the program's mission of fostering innovation in the government sector.Anil John, a public interest technologist, provided valuable insights into bridging the gap between the government and the startup community. His role in translating government needs into actionable solutions highlighted the importance of leveraging global talent to address local challenges and drive technological advancements in the public sector.The discussion explored the Silicon Valley Innovation Program's unique selection process for startups, focusing on building products that have broad utility and can be readily adopted. The success story of the protobom project transitioning into an open-source tool exemplified the program's commitment to nurturing innovative solutions with real-world applications.The significance of Software Bill of Materials (SBOM) in enhancing software supply chain visibility was emphasized, with a call to action for organizations to prioritize its inclusion in software development processes. By driving awareness and adoption of SBOM, the SVIP is empowering security leaders to enhance software security and visualization in the development pipeline.Security leaders were encouraged to explore tools and technologies that enhance software security and visualization in the development pipeline. A call to action was made to participate in the SVIP demo week to learn about innovative solutions and capabilities and to drive the adoption of SBOM within organizations.Key Questions AddressedHow does the Silicon Valley Innovation Program (SVIP) bridge the gap between government needs and startup innovations in cybersecurity?What role does the Software Bill of Materials (SBOM) play in enhancing software supply chain security?How can organizations, both public and private, benefit from the innovative solutions developed through the SVIP for software supply chain visibility?___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

Redefining Cybersecurity by Unlocking Government and Startup Collaboration While Enhancing Software Supply Chain Visibility | A Conversation with Melissa Oh and Anil John | Redefining CyberSecurity with Sean Martin

Play Episode Listen Later May 6, 2024 33:00

Guests: Melissa Oh, Managing Director, Silicon Valley Innovation Program (SVIP), DHS Science & Technology Directorate [@DHSgov]On LinkedIn | https://www.linkedin.com/in/melissa-oh/Anil John, Technical Director, Silicon Valley Innovation Program (SVIP), DHS Science & Technology Directorate [@DHSgov]On LinkedIn | https://www.linkedin.com/in/aniljohn/On Twitter | https://twitter.com/aniltj____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/sean-martinView This Show's Sponsors___________________________Episode NotesThis new episode of the 'Redefining Cybersecurity' podcast features a thought-provoking discussion on software development, supply chain security, and the innovative initiatives of the Silicon Valley Innovation Program (SVIP). The conversation was led by host Sean Martin, with insights from distinguished guests Melissa Oh, Managing Director at the Department of Homeland Security Science and Technology Directorate, and Anil John, Technical Director of the Silicon Valley Innovation Program.Melissa Oh shared her extensive experience in public service and the innovative approach of the Silicon Valley Innovation Program in identifying emerging technology companies. Her background in Silicon Valley and dedication to solving DHS's pain points through collaboration with startups underscored the program's mission of fostering innovation in the government sector.Anil John, a public interest technologist, provided valuable insights into bridging the gap between the government and the startup community. His role in translating government needs into actionable solutions highlighted the importance of leveraging global talent to address local challenges and drive technological advancements in the public sector.The discussion explored the Silicon Valley Innovation Program's unique selection process for startups, focusing on building products that have broad utility and can be readily adopted. The success story of the protobom project transitioning into an open-source tool exemplified the program's commitment to nurturing innovative solutions with real-world applications.The significance of Software Bill of Materials (SBOM) in enhancing software supply chain visibility was emphasized, with a call to action for organizations to prioritize its inclusion in software development processes. By driving awareness and adoption of SBOM, the SVIP is empowering security leaders to enhance software security and visualization in the development pipeline.Security leaders were encouraged to explore tools and technologies that enhance software security and visualization in the development pipeline. A call to action was made to participate in the SVIP demo week to learn about innovative solutions and capabilities and to drive the adoption of SBOM within organizations.Key Questions AddressedHow does the Silicon Valley Innovation Program (SVIP) bridge the gap between government needs and startup innovations in cybersecurity?What role does the Software Bill of Materials (SBOM) play in enhancing software supply chain security?How can organizations, both public and private, benefit from the innovative solutions developed through the SVIP for software supply chain visibility?___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

Smashing the Stack; All Good Things | Exploring Software Lifecycles from Secure By Design to End of Life | An RSA Conference 2024 Conversation with Allan Friedman and Bob Lord | On Location Coverage with Sean Martin and Marco Ciappelli

Play Episode Listen Later May 5, 2024 32:32

Guests: Allan Friedman, Senior Advisor and Strategist, Cybersecurity and Infrastructure Security Agency (CISA) [@CISAgov]On LinkedIn | https://www.linkedin.com/in/allanafriedman/At RSAC | https://www.rsaconference.com/experts/allan-friedmanBob Lord, Senior Technical Advisor, Cybersecurity and Infrastructure Security Agency (CISA) [@CISAgov]On LinkedIn | https://www.linkedin.com/in/lordbob/On Twitter | https://twitter.com/boblordAt RSAC | https://www.rsaconference.com/experts/Bob%20Lord____________________________Hosts: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/sean-martinMarco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society PodcastOn ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli____________________________Episode NotesIn this new On Location episode, Sean Martin hosted a conversation with Allan Friedman and Bob Lord from the Cyber Security and Infrastructure Security Agency (CISA) as part of the Chats on the Road to the RSA Conference series. The discussion centered around key topics such as securing software by design, navigating the intricacies of managing end-of-life (EOL) software, and emphasizing the crucial role of transparency in the software supply chain.Allan Friedman, a vocal advocate for the Software Bill of Materials (SBOM) — he has the t-shirt to prove it! — explored the increasing competitiveness of getting accepted to speak at renowned conferences like RSA, reflecting the growing awareness and urgency around cybersecurity topics. His upcoming RSA presentation is set to delve into the looming challenge of end-of-life and end-of-support software—a topic that, while not new, demands innovative technical and policy-level responses to mitigate emerging threats effectively.Bob Lord's discussion highlighted an area often overlooked yet critical for software security: memory safety. By sharing his experiences and underscoring the prevalence of vulnerabilities traced back to memory safety issues, Lord emphasized the necessity for developers and companies to adopt a more proactive and transparent approach in their software development practices. This call to action is not just about developing new solutions but also about ensuring that existing software is resilient against current and future threats.One of the key takeaways from this episode is the imperative of transparency in the software supply chain. As Friedman notes, the path to a more secure digital infrastructure lies in the ability to have clear visibility into the software components businesses rely on—including their age, vulnerabilities, and update requirements. This clarity is essential not only for building trust between software manufacturers and their customers but also for enabling a proactive stance on cybersecurity, which can significantly reduce the risks associated with outdated or unsupported software.Moreover, the conversation underscored the evolutionary nature of cybersecurity. As threats evolve, so too must our strategies and tools to combat them. The dialogue between Martin, Friedman, and Lord brought to light the importance of continuous learning, adaptation, and collaboration within the cybersecurity community to address these ongoing challenges.The episode represents a microcosm of the larger conversations happening within the fields of cybersecurity and software development. As we move forward, the insights shared by Allan Friedman and Bob Lord remind us of the critical importance of design security, comprehensive policies, and, above all, the need for a collective belief in the possibility of creating safer software solutions for the future.Be sure to follow our Coverage Journey and subscribe to our podcasts!____________________________Follow our RSA Conference USA 2024 coverage: https://www.itspmagazine.com/rsa-conference-usa-2024-rsac-san-francisco-usa-cybersecurity-event-infosec-conference-coverageOn YouTube:

Smashing the Stack; All Good Things | Exploring Software Lifecycles from Secure By Design to End of Life | An RSA Conference 2024 Conversation with Allan Friedman and Bob Lord | On Location Coverage with Sean Martin and Marco Ciappelli

AWS - Il podcast in italiano

Play Episode Listen Later May 5, 2024 32:32

Guests: Allan Friedman, Senior Advisor and Strategist, Cybersecurity and Infrastructure Security Agency (CISA) [@CISAgov]On LinkedIn | https://www.linkedin.com/in/allanafriedman/At RSAC | https://www.rsaconference.com/experts/allan-friedmanBob Lord, Senior Technical Advisor, Cybersecurity and Infrastructure Security Agency (CISA) [@CISAgov]On LinkedIn | https://www.linkedin.com/in/lordbob/On Twitter | https://twitter.com/boblordAt RSAC | https://www.rsaconference.com/experts/Bob%20Lord____________________________Hosts: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/sean-martinMarco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society PodcastOn ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli____________________________Episode NotesIn this new On Location episode, Sean Martin hosted a conversation with Allan Friedman and Bob Lord from the Cyber Security and Infrastructure Security Agency (CISA) as part of the Chats on the Road to the RSA Conference series. The discussion centered around key topics such as securing software by design, navigating the intricacies of managing end-of-life (EOL) software, and emphasizing the crucial role of transparency in the software supply chain.Allan Friedman, a vocal advocate for the Software Bill of Materials (SBOM) — he has the t-shirt to prove it! — explored the increasing competitiveness of getting accepted to speak at renowned conferences like RSA, reflecting the growing awareness and urgency around cybersecurity topics. His upcoming RSA presentation is set to delve into the looming challenge of end-of-life and end-of-support software—a topic that, while not new, demands innovative technical and policy-level responses to mitigate emerging threats effectively.Bob Lord's discussion highlighted an area often overlooked yet critical for software security: memory safety. By sharing his experiences and underscoring the prevalence of vulnerabilities traced back to memory safety issues, Lord emphasized the necessity for developers and companies to adopt a more proactive and transparent approach in their software development practices. This call to action is not just about developing new solutions but also about ensuring that existing software is resilient against current and future threats.One of the key takeaways from this episode is the imperative of transparency in the software supply chain. As Friedman notes, the path to a more secure digital infrastructure lies in the ability to have clear visibility into the software components businesses rely on—including their age, vulnerabilities, and update requirements. This clarity is essential not only for building trust between software manufacturers and their customers but also for enabling a proactive stance on cybersecurity, which can significantly reduce the risks associated with outdated or unsupported software.Moreover, the conversation underscored the evolutionary nature of cybersecurity. As threats evolve, so too must our strategies and tools to combat them. The dialogue between Martin, Friedman, and Lord brought to light the importance of continuous learning, adaptation, and collaboration within the cybersecurity community to address these ongoing challenges.The episode represents a microcosm of the larger conversations happening within the fields of cybersecurity and software development. As we move forward, the insights shared by Allan Friedman and Bob Lord remind us of the critical importance of design security, comprehensive policies, and, above all, the need for a collective belief in the possibility of creating safer software solutions for the future.Be sure to follow our Coverage Journey and subscribe to our podcasts!____________________________Follow our RSA Conference USA 2024 coverage: https://www.itspmagazine.com/rsa-conference-usa-2024-rsac-san-francisco-usa-cybersecurity-event-infosec-conference-coverageOn YouTube:

017 Adrian Sroka - bezpieczny kod da się zrobić

artur markiewicz podcast

Play Episode Listen Later Apr 22, 2024 90:38

017 Adrian Sroka - bezpieczny kod da się zrobićArtur Markiewicz podcasthttps://powiedzcospoinformatycznemu.pl/artur-markiewicz-podcast/ Podcast o ludziach, o branży o projektachPodcast dotyczący budowania cyberbezpieczeństwa i ludzi, którzy to robią.

ai od jak github jeden historie najwa przysz wszystkie zrobi chcesz masz edukacja budowa atak spotify apple sroka przypadek materials sbom

#171 - Navigating Software Supply Chain Security (with Cassie Crossley)

CISO Tradecraft

Play Episode Listen Later Mar 4, 2024 46:57 Transcription Available

In this episode of CISO Tradecraft, host G Mark Hardy converses with Cassie Crossley, author of the book on software supply chain security. Hardy explores the importance of cybersecurity, the structure of software supply chains, and the potential risks they pose. Crossley shares her expert insights on different software source codes and the intricacies of secure development life cycle. She highlights the significance of Software Bill of Materials (SBOM) and the challenges in maintaining the integrity of software products. The discussion also covers the concept of counterfeits in the software world, stressing the need for continuous monitoring and a holistic approach towards cybersecurity. Link to the Book: https://www.amazon.com/Software-Supply-Chain-Security-End/dp/1098133706?&_encoding=UTF8&tag=-0-0-20&linkCode=ur2 Transcripts: https://docs.google.com/document/d/1SJS2VzyMS-xLF0vlGIgrnn5cOP8feCV9 Chapters 00:00 Introduction 01:44 Discussion on Software Supply Chain Security 02:33 Insights into Secure Development Life Cycle 03:20 Understanding the Importance of Supplier Landscape 05:09 The Role of Security in Software Supply Chain 07:29 The Impact of Vulnerabilities in Software Supply Chain 09:06 The Importance of Secure Software Development Life Cycle 14:13 The Role of Frameworks and Standards in Software Supply Chain Security 17:39 Understanding the Importance of Business Continuity Plan 20:53 The Importance of Security in Agile Development 24:01 Understanding OWASP and Secure Coding 24:20 The Importance of API Security 24:50 The Concept of Shift Left in Software Development 25:20 The Role of Culture in Software Development 25:52 Exploring Different Source Code Types 26:19 The Rise of Low Code, No Code Platforms 28:53 The Potential Risks of Generative AI Source Code 34:24 Understanding Software Bill of Materials (SBOM) 41:07 The Challenge of Spotting Counterfeit Software 41:36 The Importance of Integrity Checks in Software Development 45:45 Closing Thoughts and the Importance of Cybersecurity Awareness

Container supply chain: come mettere in sicurezza tutti gli step (ospite: Simone Salsi)

Play Episode Listen Later Feb 19, 2024 49:23

Cosa si intende per Container Supply Chain? E cosa può andare storto se la catena non viene gestita nel modo corretto? Quali framework e strumenti sono a disposizione? In questo episodio ospito Simone Salsi, Solutions Architect di AWS Italia, per parlare di come creare pipeline di sviluppo e messa in produzione in grado di mitigare i rischi e massimizzare la sicurezza dei container. Link utili: SLSA: https://slsa.dev Software Bill of Materials (SBoM): https://docs.aws.amazon.com/whitepapers/latest/practicing-continuous-integration-continuous-delivery/software-bill-of-materials-sbom.html CNCF whitepaper: https://github.com/cncf/tag-security/blob/main/supply-chain-security/supply-chain-security-paper/CNCF_SSCP_v1.pdf [blog] Shift left to secure your container supply chain: https://aws.amazon.com/blogs/containers/shift-left-to-secure-your-container-supply-chain/ DevSecOps workshop: https://container-devsecops.awssecworkshops.com

shift supply chains cosa tutti container quali ospite sicurezza devsecops solutions architect mettere cncf materials sbom

#71: Cybersecurity in the Power Grid – A 360° View | Part 5

cybersecurity ot andreas omicron chief technology officer gmbh power grid listen notes materials sbom

Play Episode Listen Later Jan 16, 2024 35:49

Podcast: Energy TalksEpisode: #71: Cybersecurity in the Power Grid – A 360° View | Part 5Pub date: 2024-01-11Security engineering – building trust in digital products used in the power grid Welcome to the 5th episode of our Energy Talks miniseries, called Cybersecurity in the Power Grid, in which we provide you with a 360-degree view of how power grids can best safeguard their infrastructures from cyber-attacks. In this episode, Andreas Klien, OMICRON cybersecurity expert and Business Area Manager of Power Utility Communication, discusses the security engineering of digital products used in the power grid with his guest, Sarah Fluchs, Chief Technology Officer at admeritia GmbH. Together, they debate the question, “Can power grid operators trust their manufacturers to ensure reliable cybersecurity?” Andreas and Sarah conduct their discussion from the perspective of an OT security officer. They address the pending EU Cyber Resilience Act and how it can help better secure the power grid and other critical infrastructures by requiring manufacturers to build cybersecurity measures into their products and the significance of security certificates for digital products, especially OT devices. They also discuss the growing use of a Software Bill of Materials (SBOM) and how it can help manufacturers be more transparent and enable power grid operators to identify possible security issues in products. Lastly, Andreas and Sarah discuss the importance of open, 2-way communication between power grid operators and manufacturers to achieve security goals. Stay tuned for upcoming episodes in our Cybersecurity in the Power Grid miniseries. Learn more about our approach to cybersecurity in power grids: https://www.omicroncybersecurity.com/The podcast and artwork embedded on this page are from OMICRON electronics GmbH, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

#71: Cybersecurity in the Power Grid – A 360° View | Part 5

cybersecurity ot andreas omicron chief technology officer gmbh power grid listen notes materials sbom

Play Episode Listen Later Jan 16, 2024 35:49

Podcast: Energy TalksEpisode: #71: Cybersecurity in the Power Grid – A 360° View | Part 5Pub date: 2024-01-11Security engineering – building trust in digital products used in the power grid Welcome to the 5th episode of our Energy Talks miniseries, called Cybersecurity in the Power Grid, in which we provide you with a 360-degree view of how power grids can best safeguard their infrastructures from cyber-attacks. In this episode, Andreas Klien, OMICRON cybersecurity expert and Business Area Manager of Power Utility Communication, discusses the security engineering of digital products used in the power grid with his guest, Sarah Fluchs, Chief Technology Officer at admeritia GmbH. Together, they debate the question, “Can power grid operators trust their manufacturers to ensure reliable cybersecurity?” Andreas and Sarah conduct their discussion from the perspective of an OT security officer. They address the pending EU Cyber Resilience Act and how it can help better secure the power grid and other critical infrastructures by requiring manufacturers to build cybersecurity measures into their products and the significance of security certificates for digital products, especially OT devices. They also discuss the growing use of a Software Bill of Materials (SBOM) and how it can help manufacturers be more transparent and enable power grid operators to identify possible security issues in products. Lastly, Andreas and Sarah discuss the importance of open, 2-way communication between power grid operators and manufacturers to achieve security goals. Stay tuned for upcoming episodes in our Cybersecurity in the Power Grid miniseries. Learn more about our approach to cybersecurity in power grids: https://www.omicroncybersecurity.com/The podcast and artwork embedded on this page are from OMICRON electronics GmbH, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Unlocking Business Workflow Security: Introducing Workflow Bill of Materials (WBOM) | A Musing On the Future of Cybersecurity and Humanity with Sean Martin and TAPE3 | Read by TAPE3

Play Episode Listen Later Jan 8, 2024 11:19

Explore the cutting-edge concepts of Software Bill of Materials (SBOM) and the newly coined Workflow Bill of Materials (WBOM) in our latest newsletter article, where we unravel how these strategies can revolutionize operational transparency and business security.________This fictional story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn.Sincerely, Sean Martin and TAPE3________Sean Martin is the host of the Redefining CyberSecurity Podcast, part of the ITSPmagazine Podcast Network—which he co-founded with his good friend Marco Ciappelli—where you may just find some of these topics being discussed. Visit Sean on his personal website.TAPE3 is the Artificial Intelligence for ITSPmagazine, created to function as a guide, writing assistant, researcher, and brainstorming partner to those who adventure at and beyond the Intersection Of Technology, Cybersecurity, And Society. Visit TAPE3 on ITSPmagazine.

future explore humanity artificial intelligence unlocking cybersecurity materials data protection information security musing risk mitigation technology integration sean martin process mapping human cognition supply chain risk management operational security materials sbom business workflow

Unlocking Business Workflow Security: Introducing Workflow Bill of Materials (WBOM) | A Musing On the Future of Cybersecurity and Humanity with Sean Martin and TAPE3 | Read by TAPE3

Application Security PodCast

Play Episode Listen Later Jan 8, 2024 11:19

Explore the cutting-edge concepts of Software Bill of Materials (SBOM) and the newly coined Workflow Bill of Materials (WBOM) in our latest newsletter article, where we unravel how these strategies can revolutionize operational transparency and business security.________This fictional story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn.Sincerely, Sean Martin and TAPE3________Sean Martin is the host of the Redefining CyberSecurity Podcast, part of the ITSPmagazine Podcast Network—which he co-founded with his good friend Marco Ciappelli—where you may just find some of these topics being discussed. Visit Sean on his personal website.TAPE3 is the Artificial Intelligence for ITSPmagazine, created to function as a guide, writing assistant, researcher, and brainstorming partner to those who adventure at and beyond the Intersection Of Technology, Cybersecurity, And Society. Visit TAPE3 on ITSPmagazine.

future explore humanity artificial intelligence unlocking cybersecurity materials data protection information security musing risk mitigation technology integration sean martin process mapping human cognition supply chain risk management operational security materials sbom business workflow

#141 - Emerging Risks (with The Chertoff Group)

CISO Tradecraft

Play Episode Listen Later Aug 7, 2023 41:30

On this episode, David London and Adam Isles from the Chertoff Group stop by to discuss emerging risk topics such as AI, Supply Chain Attacks, and the new SEC regulations. Stick around and learn the tradecraft to better protect your company. Special Thanks to our Sponsors: The Chertoff Group: https://www.chertoffgroup.com.Note you can read more about their thoughts on AI here: https://www.chertoffgroup.com/managing-ai-risks/ Prelude: https://www.preludesecurity.com/ CPrime: Visit https://www.cprime.com/train to schedule an IT governance workshop to align expectations, capture priorities, and improve effective governance across your entire technology portfolio. Use the code CPRIMEPOD to get 15% off your training course purchase. Transcripts: https://docs.google.com/document/d/1tW0kOYCURXgRF-z7UqeQGga0zAkwGuZ9/ Chapters 00:00 Introduction 02:33 The SEC's Final Rule on Cybersecurity Disclosure 05:29 What is a Material Incident? 07:13 The Commission's Final Rule on Board Engagement in Cybersecurity Risk 10:03 The Four Day Rule for Incident Reporting 12:46 The Implications of the New Role of the CISO 15:46 The Ticking Clock on Disclosure 18:31 SolarWinds and the Software Chain Security Exposure 19:53 The Role of the Software Bill of Materials (SBOM) in the Software Supply Chain Security Challenges 21:29 The Rise of the SBOM 23:16 The Rise of Expectations in the U.S. Government 25:02 The Future of Software Security 27:22 The Progress of the CMMC Program 29:59 The SEC Disclosure Requirements: What to Expect From Your Board 31:57 How to Reduce Complexity in Your Software Development Lifecycle 34:05 How AI is Impacting Our Business and Cyber 37:32 How to Measure and Manage Cyber Risks Effectively 39:57 The SEC's Final Rule on Disclosure

ai future expectations progress risks sec commission measure implications emerging disclosure new role solarwinds final rule supply chain attacks chertoff group materials sbom david london

Paul McCarty -- The Burrito Analogy of the Software Supply Chain

Play Episode Listen Later Jul 14, 2023 33:46 Transcription Available

"Visualizing the Software Supply Chain" is a project which aims to kick off a discussion about the scope and breadth of the software supply chain.Paul McCarty emphasizes the importance of understanding what's in the software supply chain to secure it effectively. He uses the burrito analogy, stating that you can't decide if you want to eat it if you don't know what's in it. We discuss the nuances around the Software Bill of Materials (SBOM) and the importance of understanding the differences between various SBOMs, especially for companies that deploy frequently.The conversation also covers third-party components, such as APIs, SaaS solutions, payment gateways, and identity providers, which are part of the software supply chain. Paul gives the example of Stripe, a payment platform that includes software components and SaaS.Paul's project helps people understand the different threats associated with each category in the software supply chain. The episode concludes with a call to action for organizations to prioritize understanding their software supply chain and leveraging automation as much as possible.Gain valuable insights into securing the software supply chain and consider guidance on actionable steps organizations can take to enhance their security.Four key takeaways from the episode:Understanding the Software Supply Chain: Paul McCarty emphasizes the importance of understanding the scope and breadth of the software supply chain. He suggests you can't secure or have a valuable conversation about the software supply chain if you don't know what's in it.The Role of Third-Party Components: Third-party components in the software supply chain are crucial. These can include APIs, SaaS solutions, payment gateways, and identity providers. Paul uses Stripe as an example to illustrate this point.The Nuances of the Software Bill of Materials (SBOM): SBOM has nuance. We highlight the importance of understanding the differences between various SBOMs, especially for companies that deploy frequently.Threat Thinking in the Software Supply Chain: We appreciate the depth of threat thinking in Paul's project. This approach helps people understand the different threats associated with each category in the software supply chain.Links:https://github.com/SecureStackCo/visualizing-software-supply-chainhttps://github.com/6mile/DevSecOps-PlaybookFOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast➜LinkedIn: The Application Security Podcast➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

software saas supply chains apis burritos stripe visualizing nuances analogy mccarty sboms materials sbom

How Big is Your Data? The Increasing Demand for Detailed, Actionable Information in Cybersecurity, with Dino Boukouris, Founder and Managing Director, Momentum Cyber

To The Point - Cybersecurity

Play Episode Listen Later Jun 21, 2023 23:49

In this episode of the IoT: The Internet of Threats podcast, host Eric Greenwald and Dino Boukouris, Founder and Managing Director of Momentum Cyber, delve into the increasing demand for detailed, actionable data in providing cybersecurity services. Eric and Dino scrutinize the role of regulations, assessing whether they inspire innovation or inadvertently stifle growth. They also examine the crucial part that data analytics and Software Bill of Materials (SBOM) play in today's risk management practices. Will the increased prevalence of AI and emerging regulations bring about significant improvements in managing cyber risks? Join the conversation to find out. Interview with Dino Boukouris Dino Boukouris is a Founder of Momentum Cyber as well as its Managing Director. Momentum serves as a strategic advisor to founders, CEOs, and boards in the cybersecurity space. Dino specializes in cybersecurity, M&A, venture capital and private equity. He also has a background in engineering and finance. Prior to founding Momentum Cyber, Dino served in a variety of capacities at strategic advisory services and VC firms, including Illuminate Ventures and Advatech Advisors. Earlier in his career, he held the position of Engineering Manager at Cameron Health, a start-up later acquired by Boston Scientific. Dino earned an MBA with honors from UC Berkeley's Haas School of Business and a Masters of Science degree in Mechanical Engineering from the University of Michigan's College of Engineering. In this episode, Eric and Dino discuss: The increasing sophistication of cybersecurity threats and marketplace demand for better data risk management The role of regulation in driving and governing the proliferation of AI and whether it also stifles growth The double-edged sword that these advances bring to cybersecurity tools and threats Whether AI's promises of efficiency will be a game-changer to today's cybersecurity practices Find Dino on LinkedIn: Dino Boukouris: https://www.linkedin.com/in/konstantinosboukouris/ Learn more about Momentum Cyber: https://www.linkedin.com/company/momentumcyber/ Thank you for listening to this episode of the IoT: The Internet of Threats podcast, powered by Finite State — the leading supply chain cyber-security solution provider for connected devices and embedded systems. If you enjoyed this episode, click subscribe to stay connected and leave a review to get the word out about the podcast. To learn more about building a robust software supply chain security program, protecting your connected devices, and complying with emerging regulations and technical standards, visit https://finitestate.io/

Stackd 65: Devnexus, indeed

Enterprise Java Newscast

Play Episode Listen Later May 21, 2023 111:09

Danno, Josh and Kito recap the always-amazing Devnexus and a discuss a wide-range of topics, including TypeScript 5, RIFE2, Hilla, OpenJFX, Adobe buying Figma, Quarkus, JakartaEE 11, AWS Application Composer, Rust, Java 20, SBOMs, Kotlin, and more. We Thank DataDog for sponsoring this podcast! https://www.pubhouse.net/datadog Front End - Anyone heard of Eclipse Scout - A one-stop framework to develop professional business applications? (https://www.eclipse.org/scout/) - Announcing TypeScript 5.0Eclipse Scout - A one-stop framework to develop professional business applications - PrimeOne 2.0 for Figma (https://www.primefaces.org/introducing-primeone-2-0-for-figma/) - Adobe to buy Figma (https://news.adobe.com/news/news-details/2022/Adobe-to-Acquire-Figma/default.aspx) - RIFE2 (https://rife2.com/) - Hilla 2.0: New features and an improved technology baseline using Spring Boot 3 and Java 17 (https://hilla.dev/blog/hilla-2-0-release/) - OpenJFX 20 Released (https://gluonhq.com/products/javafx/openjfx-20-release-notes/) - Hands-On Selenium WebDriver with Java: A Deep Dive into the Development of End-to-End Tests (https://www.amazon.com/Hands-Selenium-WebDriver-Java-End/dp/1098110005) Server Side Java - Quarkus dropping MicroProfile Metrics (https://vived.io/much-ado-about-observability-jep-making-profiling-easier-and-quarkus-dropping-microprofile-standard/) - Visualize and create your serverless workloads with AWS Application Composer (https://aws.amazon.com/blogs/compute/visualize-and-create-your-serverless-workloads-with-aws-application-composer/?sc_icampaign=launch_aws-application-composer-preview_reinvent22&sc_ichannel=ha&sc_icontent=awssm-12026_launch_reinvent22&sc_i) - Jakarta EE 11 Discussion (https://docs.google.com/document/d/1m-dkvbL0iFFzitO4vt1SVq6GGSJyFdCDM2NU_FzGS10/edit?hss_channel=tw-939323243076259842#heading=h.1oyn459kodrn) News - Don't call it Rust: Community complains about draft trademark policy restricting use of 'word marks' (https://devclass.com/2023/04/11/dont-call-it-rust-community-complains-about-draft-trademark-policy-restricting-use-of-word-marks/) Java Platform - Qbicc's - Experimental static compiler for Java programs. (https://github.com/qbicc/qbicc) - Java 20 is Out (https://inside.java/2023/03/21/the-arrival-of-java-20/) - Java: Developing smaller Docker images with jdeps and jlink | by Joe Honour | Level Up Coding (https://levelup.gitconnected.com/java-developing-smaller-docker-images-with-jdeps-and-jlink-d4278718c550) Other - Software Bill of Materials (SBOM) (https://apiiro.com/blog/practical-guide-to-sbom/) - Snyk (https://snyk.io/) - Nexus Lifecycle - Control Open Source Risk | Sonatype (https://www.sonatype.com/products/open-source-security-dependency-management) - DependencyTrack (https://dependencytrack.org/) - Brian Fox - OpenSSF Governing Board Member (https://www.linkedin.com/in/brianefox) - Kotlin 1.8.20 (https://kotlinlang.org/docs/whatsnew1820.html) Picks - Rectangle Mac (Kito) (https://rectangleapp.com/) - The Big Door Prize (Josh) (https://tv.apple.com/us/show/the-big-door-prize/umc.cmc.2rjxcljdjz4h47vjdxnytcn23?ctx_brand=tvs.sbd.4000) - ChatGPT for Code (Danno) (https://openai.com/blog/chatgpt) - Atlanta's Breakfast Club (Danno) (https://www.atlbreakfastclub.com/) Other Pubhouse Network podcasts - Breaking into Open Source (https://www.pubhouse.net/breaking-into-open-source) - OffHeap (https://www.javaoffheap.com/) - Java Pubhouse (https://www.javapubhouse.com/) Events - JCON EUROPE 2023 - June 20-23, Cologne Köln, Germany (https://jcon.one/) - JPrime - May 30-31st, Sofia, Bulgaria (https://jprime.io/) - Central Iowa Software Symposium - June 9 - 10, Des Moines, IA, USA (https://nofluffjuststuff.com/desmoines) - Lone Star Software Symposium - July 14 - 15, Austin, TX, USA (https://nofluffjuststuff.com/austin) - ÜberConf - July 18 - 21, Denver, CO, USA (https://uberconf.com/) - JChampions Conference Sessions Recorded online…https://jchampionsconf.com/ (https://jchampionsconf.com/)

CBOMs and Automating Compliance Problem Solving with Brian Hajost

Play Episode Listen Later Feb 14, 2023 42:32

Joining the podcast this week is Brian Hajost, the founder and COO of SteelCloud. Brian shares insights on his concept of a Compliance Bill of Materials (CBOM). For those that have heard of Software Bill of Materials (SBOM) it's a similar concept. In addition to CBOM's, Brian also breaks down the challenges and opportunities in automating compliance as well as well frameworks organizations can leverage to help them achieve compliance. Compliance is a super hot topic for every organization! This is a podcast you don't want to miss! Brian Hajost, Chief Operating Officer at SteelCloud, LLC Brian Hajost is the founder and COO of SteelCloud, a company that develops technology for automated compliance for DISA STIGs and the CIS Security Benchmarks. Mr. Hajost has transformed SteelCloud into a recognized leader in delivering new technologies that allow government customers and commercial enterprises to effectively meet the compliance mandates of RMF, NIST 800-53, NIST 800-171, CMMC, and IRS Pub 1075. Brian's technical career has spanned over thirty years, primarily with leading-edge technologies in regulated industries. He holds 10 patents in IT security and two patents in mobile security. Mr. Hajost is an active contributor to AFCEA International through his membership on the Technology Committee and Secure Supply Chain subcommittee. He is also the Vice Chair of the Advanced Technology Academic Research Center (ATARC) Continuous ATO Working Group. For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e220

coo compliance chief operating officer vice chair problem solving automating nist technology committee rmf materials sbom

ESW #305 - Tom Goings, Ashley Leonard

Paul's Security Weekly

Play Episode Listen Later Feb 10, 2023 147:03

Tanium has recently released a new capability called Tanium Software Bill of Materials (SBOM) to help customers identify third-party libraries associated with software packages. • What is Tanium SBOM • Why is it different and why do you need it • How to configure SBOM • How to query for the details about every software application in your environment • Where your vulnerable packages exist • Ways that Tanium can remediate vulnerabilities from OpenSSL to Struts to Log4j today as well as new supply-chain vulnerabilities in the future No one knows what the next supply chain vulnerability is going to be, but with Tanium, you will have access to data about how your applications are affected before it happens so that when it does, you're ready to take action to remediate the issue from within the Tanium XEM platform. Segment Resources: https://www.tanium.com/products/tanium-sbom/ https://www.tanium.com/press-releases/tanium-launches-software-bill-of-materials-for-unprecedented-visibility-to-combat-supply-chain-threats/ https://www.tanium.com/blog/software-bill-of-materials-openssl/ This segment is sponsored by Tanium. Visit https://securityweekly.com/tanium to learn more about them! Syxsense and Enterprise Management Associates (EMA) recently teamed up to publish a survey around the current state of Zero Trust within enterprises as well as where it's going. This interview will discuss the key findings and insights into the challenges many organizations face around Zero Trust, as well as endpoint security and network access. Segment Resources: https://www.syxsense.com/advancing-zero-trust-priorities In the Enterprise News: Whether you want insurtechs or not, they're here and you're getting them! Don't worry - we'll explain what insurtechs are. Two potential deals to take security companies private: Sumo Logic and Rapid 7! Looks like 32 year old security company Cyren is shutting down, hoping for an asset sale. They've already laid off all their employees. Big drama: a firm shorts Darktrace and releases a scathing report. We've got yet more more layoffs this week, but don't fret - the NSA is hiring! For our squirrel stories, we'll be deciding between three stories: codebreakers solve 500 year old ciphers, the real cost of meetings visualized, and sushi terrorists! All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly Show Notes: https://securityweekly.com/esw305

rapid nsa zero trust goings struts openssl darktrace sumo logic tanium materials sbom enterprise security weekly segment resources

ESW #305 - Tom Goings, Ashley Leonard

Enterprise Security Weekly (Audio)

Play Episode Listen Later Feb 10, 2023 147:03

Tanium has recently released a new capability called Tanium Software Bill of Materials (SBOM) to help customers identify third-party libraries associated with software packages. • What is Tanium SBOM • Why is it different and why do you need it • How to configure SBOM • How to query for the details about every software application in your environment • Where your vulnerable packages exist • Ways that Tanium can remediate vulnerabilities from OpenSSL to Struts to Log4j today as well as new supply-chain vulnerabilities in the future No one knows what the next supply chain vulnerability is going to be, but with Tanium, you will have access to data about how your applications are affected before it happens so that when it does, you're ready to take action to remediate the issue from within the Tanium XEM platform. Segment Resources: https://www.tanium.com/products/tanium-sbom/ https://www.tanium.com/press-releases/tanium-launches-software-bill-of-materials-for-unprecedented-visibility-to-combat-supply-chain-threats/ https://www.tanium.com/blog/software-bill-of-materials-openssl/ This segment is sponsored by Tanium. Visit https://securityweekly.com/tanium to learn more about them! Syxsense and Enterprise Management Associates (EMA) recently teamed up to publish a survey around the current state of Zero Trust within enterprises as well as where it's going. This interview will discuss the key findings and insights into the challenges many organizations face around Zero Trust, as well as endpoint security and network access. Segment Resources: https://www.syxsense.com/advancing-zero-trust-priorities In the Enterprise News: Whether you want insurtechs or not, they're here and you're getting them! Don't worry - we'll explain what insurtechs are. Two potential deals to take security companies private: Sumo Logic and Rapid 7! Looks like 32 year old security company Cyren is shutting down, hoping for an asset sale. They've already laid off all their employees. Big drama: a firm shorts Darktrace and releases a scathing report. We've got yet more more layoffs this week, but don't fret - the NSA is hiring! For our squirrel stories, we'll be deciding between three stories: codebreakers solve 500 year old ciphers, the real cost of meetings visualized, and sushi terrorists! All that and more, on this episode of Enterprise Security Weekly. Visit https://www.securityweekly.com/esw for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly Show Notes: https://securityweekly.com/esw305

rapid nsa zero trust goings struts openssl darktrace sumo logic tanium materials sbom enterprise security weekly segment resources

Achieve Unprecedented Visibility into Your Software Supply Chain - Tom Goings - ESW #305

Paul's Security Weekly TV

Play Episode Listen Later Feb 9, 2023 50:17

Tanium has recently released a new capability called Tanium Software Bill of Materials (SBOM) to help customers identify third-party libraries associated with software packages. • What is Tanium SBOM • Why is it different and why do you need it • How to configure SBOM • How to query for the details about every software application in your environment • Where your vulnerable packages exist • Ways that Tanium can remediate vulnerabilities from OpenSSL to Struts to Log4j today as well as new supply-chain vulnerabilities in the future No one knows what the next supply chain vulnerability is going to be, but with Tanium, you will have access to data about how your applications are affected before it happens so that when it does, you're ready to take action to remediate the issue from within the Tanium XEM platform. Segment Resources: https://www.tanium.com/products/tanium-sbom/ https://www.tanium.com/press-releases/tanium-launches-software-bill-of-materials-for-unprecedented-visibility-to-combat-supply-chain-threats/ https://www.tanium.com/blog/software-bill-of-materials-openssl/ This segment is sponsored by Tanium. Visit https://securityweekly.com/tanium to learn more about them! Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw305

software achieve supply chains visibility unprecedented goings struts openssl tanium materials sbom segment resources

Achieve Unprecedented Visibility into Your Software Supply Chain - Tom Goings - ESW #305

Enterprise Security Weekly (Video)

Play Episode Listen Later Feb 9, 2023 50:17

Tanium has recently released a new capability called Tanium Software Bill of Materials (SBOM) to help customers identify third-party libraries associated with software packages. • What is Tanium SBOM • Why is it different and why do you need it • How to configure SBOM • How to query for the details about every software application in your environment • Where your vulnerable packages exist • Ways that Tanium can remediate vulnerabilities from OpenSSL to Struts to Log4j today as well as new supply-chain vulnerabilities in the future No one knows what the next supply chain vulnerability is going to be, but with Tanium, you will have access to data about how your applications are affected before it happens so that when it does, you're ready to take action to remediate the issue from within the Tanium XEM platform. Segment Resources: https://www.tanium.com/products/tanium-sbom/ https://www.tanium.com/press-releases/tanium-launches-software-bill-of-materials-for-unprecedented-visibility-to-combat-supply-chain-threats/ https://www.tanium.com/blog/software-bill-of-materials-openssl/ This segment is sponsored by Tanium. Visit https://securityweekly.com/tanium to learn more about them! Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw305

software achieve supply chains visibility unprecedented goings struts openssl tanium materials sbom segment resources

Episode 69: Secured Supply Chain and Software Bill of Materials (SBOM)

The Azure Security Podcast

Play Episode Listen Later Feb 2, 2023 27:20

In this episode, Michael and Mark talk to Adrian Diglio about Software Bill of Materials and its role in helping secure the software supply chain.We also have news items about SQL Server, Azure SQL DB, Azure Database for PostgreSQL, Azure Database for MySQL and Application Secure Groups and Private Endpoints. Mark goes over MCRA, Immutable Laws of Cybersecurity and Security Architecture Design.

software cybersecurity supply chains materials secured mysql postgresql sql server immutable laws sbom materials sbom azure sql db

S2E2: "Software Libraries, SBOMs & Wicked Privacy, Oh My!" with Michelle Dennedy (PrivacyCode)

The Shifting Privacy Left Podcast

Play Episode Play 60 sec Highlight Listen Later Jan 10, 2023 57:33 Transcription Available

Michelle Dennedy is Co-Founder & CEO of PrivacyCode, Inc., Partner at Privatus Consulting, and the Co-Author of The Privacy Engineer's Manifesto. In our lively conversation, we discuss the digital cost of information, the privacy problems that her company solves for, and how the Privatus Wicked Privacy™ framework differs from other approaches.---------Thank you to our sponsor, Privado, the developer-friendly privacy platform---------As Michelle puts it, we're living in an ‘innovation palooza' right now. But, there's still progress to be made. Michelle highlights how we can change the investment proposition to get more VCs and investors to see privacy is a strategic business enabler. At PrivacyCode, they're focused on creating a simple way to communicate the language of ‘people data' across specialities.Part of the solution includes having a software bill of materials (SBOM), which is essentially a list of ingredients that make up software components. Michelle shares a tangible example of how an SBOM creates flow, compliance, and transparency in new areas of tech. She also touches on her consulting work, including her simple strategy for determining privacy benefit metrics.Topics Covered:Privacy as a strategic enablerWhy Michelle thinks "today's VCs are more of a mood than an algorithm"How PrivacyCode allows users to orchestrate requirements across various departments and lets specialists operate in their "zone of genius"What a Software Bill of Materials (SBOM) is & why we need one to ensure privacyMichelle's advice to privacy engineers on how to leverage an SBOM for quality codeMichelle's work at Privatus Consulting and their Wicked Privacy FrameworkExamples of creative, straightforward privacy metricsResources Mentioned:Learn more about PrivacyCode & schedule a demoLearn more about Privatus ConsultingTrillions: Thriving in the Emerging Information EcologyGuest Info:Follow Michelle on LinkedInFollow Michelle on TwitterRead The Privacy Engineer's Manifesto: Getting from Policy to Code to QA to Value Privado.ai Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.Shifting Privacy Left Media Where privacy engineers gather, share, & learnBuzzsprout - Launch your podcast Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.Copyright © 2022 - 2024 Principled LLC. All rights reserved.

Episode 45: Live From the Big House

The Great Security Debate

Play Episode Listen Later Oct 30, 2022 45:05

Recorded on Saturday 29 October 2022, at the tailgate before the University of Michigan vs Michigan State University (American) football game, Brian, Erik and Dan chat about the news of the day, with more than a few correlations back to football. And we had a special guest join us, too: Zah Gonzalvo Rodriguez (https://www.linkedin.com/in/zahira-zah-rodriguez-gonzalvo-1a97692/) There was an upcoming OpenSSL vulnerability hitting the world this week. How would Software Bill of Materials (SBOM) make the response easier? A reminder of our dependence on the stability and security of some very core tools (like OpenSSL) to run our businesses. Mot to mention the fact that such tools are often within the libraries we use and don't even realise it's there. Similarities between football and security in the need to adjust based on what the other team shows signs of throwing at you, and further based on what they actually bring to the line. How repeatable process and inventory help make the response to these vulnerability disclosures less like a firedrill and more like standard ops. Did you know that credit ratings are being affected by information security posture and breach response? Same thing with M&A and investment valuation… if you're not as mature in security and privacy you may see a discount taken on your value! How transparent should we be with the peer companies and the public world about our security posture (like incident response plans, and security controls in place)? And if you're curious, you can find out what team Dan (the lifelong Badger) was supporting in the game. Congratulations to the University of Michigan in later winning this game, and to both teams for keeping the rivalry alive and spicy. We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes. Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links. Thanks for listening!

university michigan debate security privacy congratulations similarities mot badger ciso big house openssl materials sbom

Software Bill of Materials (SBOM) [ML B-side]

Malicious Life

Play Episode Listen Later Aug 31, 2022 25:20

In May 2021, Following the Solarwinds and the Colonial Pipeline attacks, the Biden administration published a presidential Executive Order mandating the use of SBOMs - Software Bill of Materials - in all government agencies. What are SBOMs and how useful are they in cybersecurity? Nate Nelson talks to two experts: Allan Friedman (CISA) and Chris Blask (Cybeats).

joe biden software materials executive orders colonial pipeline solarwinds b side sbom sboms materials sbom

Software Bill of Materials (SBOM) [ML B-side]

joe biden software materials executive orders pub colonial pipeline solarwinds b side listen notes sbom sboms cybereason materials sbom

Play Episode Listen Later Aug 31, 2022 25:20

Podcast: Malicious Life (LS 58 · TOP 0.5% what is this?)Episode: Software Bill of Materials (SBOM) [ML B-side]Pub date: 2022-08-31 In May 2021, Following the Solarwinds and the Colonial Pipeline attacks, the Biden administration published a presidential Executive Order mandating the use of SBOMs – Software Bill of Materials – in all government agencies. What are SBOMs and how useful are they in cybersecurity? Nate Nelson talks to two experts: Allan Friedman (CISA) and Chris Blask (Cybeats). The podcast and artwork embedded on this page are from Cybereason, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

DKT43 Thoughtworks technology radar vol.26

The DevOps Kitchen Talks's Podcast

Play Episode Listen Later Jul 28, 2022 109:32

TТайминг: 00:00:00 Начало 00:02:07 Thoughtworks radar 00:02:58 Макс все еще не готов монтажить 00:04:07 Что за radar? 00:06:16 Квадранты радара 00:09:54 И сново Martin Fowler 00:11:42 Four key metrics 00:14:38 Single team remote wall 00:19:11 Definition of production readiness 00:24:10 Documentation quadrants 00:30:07 Rethinking remote standups 00:36:13 Server-driven UI 00:37:52 Software bill of Materials (SBOM) 00:40:54 Tactical Forking 00:44:29 Transitional architecture 00:48:19 CUPID 00:50:25 Operator pattern for non clustered resources 00:51:27 Service mesh without sidecar 00:55:56 SLSA 00:57:22 Platforms 00:58:05 Azure DevOps, Azure DevOps pipeline templates 00:59:02 Circle CI 01:00:07 Почему столько CI/CD тулов? 01:02:27 Reusable workflows in Github Actions 01:05:52 Sealed Secrets 01:08:25 actions-runner-controller 01:10:15 Colima 01:14:17 eBPF 01:15:00 Tools 01:15:17 tfsec 01:16:40 cert-manager 01:18:06 Cloud Carbon Footprint 01:20:01 Conftest 01:20:46 kube-score 01:21:51 Lighthouse 01:24:22 NUKE 01:27:00 Podman 01:28:33 Syft 01:28:54 CDKTF 01:31:15 Excalidraw 01:34:15 Github Codespaces 01:36:25 GoReleaser 01:36:44 Grype 01:37:30 Infracost 01:41:51 jc 01:42:55 skopeo 01:44:46 Languages & Frameworks 01:45:43 Bicep 01:46:25 WebAssembly Ссылки: Web Vitals - https://www.youtube.com/watch?v=T6Eu4wkTdAY Сказать спасибо: https://www.patreon.com/devopskitchentalks Музыка: https://www.bensound.com/

service single software definition rethinking operator server documentation transitional reusable ci cd thoughtworks azure devops web vitals materials sbom thoughtworks technology radar

Risky Business #672 -- "Expected behaviour" is in the eye of the beholder

Risky Business

Play Episode Listen Later Jul 20, 2022

On this week's show Patrick Gray and Adam Boileau discuss the week's security news, including: A look at the DHS Cyber Safety Review Board's Log4j report Joshua Schulte no longer the “alleged” Vault7 leaker Chinese APT crews targeted US political journalists before Jan 6 Ransomware gangs make leak sites searchable Why recovering plaintext passwords from Okta is expected behaviour US Government seizes North Korean ransomware payment Much, much more This week's show is brought to you by Trail of Bits. Dan Guido is this week's sponsor guest and he'll tell us about work Trail of Bits did for DARPA on investigating blockchain security fundamentals. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that's your thing. Show notes Patrick Gray on Twitter: "During our discussion yesterday on the show we didn't know pre-existing MDM was preserved when iOS lockdown mode is enabled, which is great!" / Twitter DHS Cyber Safety Review Board found no evidence China knew of Log4j before disclosure Ex-CIA Hacker Convicted for ‘One of the Most Damaging Acts of Espionage in American History' Chinese hackers targeted U.S. political reporters just ahead of Jan. 6 attack, researchers say Experts concerned about ransomware groups creating searchable databases of victim data - The Record by Recorded Future Who-is-Trickbot.pdf A Deep Dive Into the Residential Proxy Service ‘911' – Krebs on Security Risky Biz News: Google removes app permissions from the Play Store Ongoing phishing campaign can hack you even when you're protected with MFA | Ars Technica ‘Password extraction risk' in identity provider Okta disputed | The Daily Swig Authomize Discovers Password Stealing and Impersonation Risks in Okta | Authomize.com Okta Response to Security Report | Okta DOJ seized ransoms paid by health centers in Kansas, Colorado after 2021 attacks - The Record by Recorded Future North Korean hackers target small businesses with H0lyGh0st ransomware, Microsoft warns - The Record by Recorded Future Colorado police investigating ransomware attack on small town - The Record by Recorded Future Albania shuts down government websites, services due to wide ranging cyberattack - The Record by Recorded Future Bandai Namco confirms cyberattack after ransomware group threatens leak - The Record by Recorded Future MiCODUS MV720 GPS tracker | CISA Honda redesigning latest vehicles to address key fob vulnerabilities - The Record by Recorded Future Russia Released a Ukrainian App for Hacking Russia That Was Actually Malware Are blockchains decentralized? | Trail of Bits Blog Announcing the new Trail of Bits podcast | Trail of Bits Blog GitHub - trailofbits/it-depends: A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.

Securing the DevOps Pipeline - You Can Do It the Way Intel Does! - with Darren Pulsipher

Play Episode Listen Later Jun 6, 2022 31:12

In this episode of the IoT: The Internet of Threats podcast, host Eric Greenwald and the Vidovich brothers Nick and Sam hack the headlines – they discuss the latest news in security and offer their perspectives. Eric also interviews guest Darren Pulsipher, Chief Solutions Architect at Intel Corporation, about supply chain security at Intel. Hacking the Headlines: Researchers warn of the huge risks involved in the rapid deployment of AI in agriculture, noting that cyberattacks on high-tech farm equipment could threaten the global food supply chain. Netgear recently issued a security advisory outlining vulnerabilities in two popular router models. According to Netgear, they are unfixable. Is this a responsible disclosure, or does it just raise more questions/concerns than it addresses? A malicious Python package that performs supply chain attacks was spotted in the PyPI registry. It was downloaded 325 times before being removed. Is this more serious than funny, or more funny than serious? Interview with Darren Pulsipher: Darren has been working on security solutions with Intel for 12 years. He's seen from the inside how to build robust security into the software development and supply chain processes. In addition to his day job, he hosts his own tech podcast and is part of a standards body working to articulate how organizations should use the Software Bill of Materials (SBOM) to secure software and meet regulatory requirements. Eric and Darren discuss: Intel's process for analyzing third-party software and scanning for vulnerabilities Securing the DevOps pipeline Balancing value and risk in using open-source software Potential impacts of Executive Order 14028 on improving the nation's cybersecurity Find Darren on LinkedIn: https://www.linkedin.com/in/darrenpulsipher/ Thank you for listening to this episode of the IoT: The Internet of Threats podcast, powered by Finite State — the leading supply chain cyber-security solution provider for connected devices and embedded systems. If you enjoyed this episode, click subscribe to stay connected and leave a review to get the word out about the podcast. To learn more about building a robust product security program, protecting your connected devices, and complying with emerging regulations and technical standards, visit https://finitestate.io/.

ai interview balancing threats intel hacking pipeline securing executive orders python devops intel corporation netgear pypi pulsipher materials sbom finite state

The SBOM Is Coming, with Allan Friedman

Application Security PodCast

Play Episode Listen Later May 10, 2022 37:07

This week's episode of the IoT: The Internet of Threats podcast features host Eric Greenwald reviewing security news with Nick and Sam, the Vidovich brothers and discussing the future of the Software Bill of Materials (SBOM) Allan Friedman, Senior Advisor and Strategist at CISA. News Roundup: This week's Weekly News Roundup covers: Lessons that IT professionals can take away from the new Windows patch The importance of boardrooms bracing for supply chain cyberattacks The importance of the SBOM in addressing cybersecurity supply chain risk Interview with Allan Friedman: Allan is the former Director of Cybersecurity Initiatives at NTIA and has been one of the central figures in advancing the Software Bill of Materials (SBOM) as a key element of product and supply-chain cybersecurity. Allan and Eric discuss: The history of the SBOM Increasing adoption of the SBOM as a security practice How SBOMs may be mandated under federal rules Misconceptions and myths around the SBOM Connect with Allan Friedman: https://www.linkedin.com/in/allanafriedman Learn more about CISA at: https://www.cisa.gov/ Thank you for listening to this episode of the IoT: The Internet of Threats podcast, powered by Finite State — the leading product security solution provider for connected devices and embedded systems. If you enjoyed this episode, click subscribe to stay connected and leave a review to get the word out about the podcast. To learn more about building out a robust product security program, protecting your connected devices, and complying with emerging regulations and technical standards, visit https://finitestate.io/.

director interview lessons threats windows misconceptions strategist senior advisor friedman cisa ntia sbom weekly news roundup materials sbom finite state

Patrick Dwyer -- CycloneDX and SBOMs

Play Episode Listen Later May 3, 2022 28:33

Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project. A lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.

dwyer servicenow co leader application security sboms materials sbom cyclonedx

Product Security Teams: How the Heck Do You Run Them? - with Josh Corman

trust security software improving supply chains barak scribe sboms materials sbom

Play Episode Listen Later Apr 25, 2022 35:41

On this week's episode of IoT: The Internet of Threats podcast, host Eric Greenwald discusses recent news in product and supply-chain cybersecurity with Nick and Sam, the Vidovich brothers. He interviews Joshua Corman, former Chief Strategist at CISA COVID Task Force and Founder of I am The Cavalry. News Roundup: This week's Weekly News Roundup covers: Assessing the difference between Spring4Shell and Log4j vulnerabilities New draft, bipartisan legislation that would require SBOMs for medical devices Interview with Josh Corman: Josh has worked in security for many years. His background includes a lot of in-depth work in cyber and physical security for medical devices. Josh is also widely known as the godfather of the Software Bill of Materials (SBOM). All of this experience led to his recent work with the government as the Chief Strategist for the CISA COVID Task Force. On the episode, Josh and Eric discuss the key functions of a product security team and the critical leadership role of the Chief Product Security Officer. Josh and Eric also discuss: How a world increasingly dependent on digital infrastructure can be protected Trends and forces that have made product security roles increasingly important General principles for prioritizing and accurately interpreting the severity of threat reports Guidance for teams that lack sufficient resources How to buy down more risk with fewer resources Connect with Josh Corman: https://www.linkedin.com/in/joshcorman/ Learn more about I am The Cavalry at https://iamthecavalry.org/ Read up on the Health Care Industry Cybersecurity Task Force here: https://www.phe.gov/Preparedness/planning/CyberTF/Pages/default.aspx Thank you for listening to this episode of IoT: The Internet of Threats podcast, powered by Finite State — the leading product security solution provider for connected devices and embedded systems. If you enjoyed this episode, click subscribe to stay connected and leave a review to get the word out about the podcast. To learn more about building out a robust product security program, protecting your connected devices, and complying with emerging supply-chain cybersecurity regulations and technical standards, visit https://finitestate.io/.

founders interview product threats guidance heck assessing preparedness chief strategist cavalry corman sboms security teams weekly news roundup spring4shell materials sbom joshua corman finite state

Improving Software Supply Chain Trust w/ Barak Brudo, Scribe Security

DevSec For Scale Podcast

Play Episode Listen Later Mar 15, 2022 27:04

What is code integrity and how does it affect the software supply chain? Have you heard about Log4j? In this episode, I talk with Barak Brudo, Developer Relations Advocast at Scribe Security about the Software Bill of Materials (SBOM) that helps to ensure all your code and packages are secure, down to the file level. By utilizing automated SBOMs, both companies and users can better understand what packages are being used, what dependencies, what file versions, and more are in your software. All this makes dealing with supply chain problems much easier by ensuring the integrity of all the packages and files being utilized.

SDCast #141: в гостях Александр Герасимов, директор по информационной безопасности в Awillix и Сергей Овчинников, cloud security architect

SDCast

Play Episode Listen Later Feb 7, 2022 121:50

Рад представить вам 141-й выпуск подкаста, в котором речь вновь идёт про безопасность приложений. У меня в гостях Александр Герасимов, директор по информационной безопасности в компании Awillix и Сергей Овчинников, cloud security architect. В этом выпуске мы говорим о том, что же такое Application Security (AppSec), как обеспечивается безопасность на всех этапах жизненного цикла разработки ПО, какие методы и подходы применяются в тех или иных случаях. Обсуждаем взаимодействие бизнеса, разработки, специалистов по информационной безопасности и devops инженеров. Обсуждаем различные подходы, приёмы и инструменты для непосредственно разработки безопасных приложений, такие как шаблоны приложений, инструменты анализа кода, подходы к созданию контейнеров и базовых образов. Отдельно поговорили про фаззинг приложений: что это такое, как он устроен и как его применять. Не обошли стороной тему кадров и знаний: обсудили где искать специалистов и как выращивать своих, где черпать знания и какие в принципе знания необходимы специалисту по информационной безопасности. В заключении выпуска немного подискутировали о будущем сферы информационной безопасности. Ссылки на ресурсы по темам выпуска: * Just Security (https://t.me/justsecurity). Телеграм канал Александра про исследования, тренды и личный опыт в кибербезопасности. * ISO/IEC 27034-6 Information technology, Security techniques, Application security (https://www.iso.org/standard/60804.html) * CIS Benchmarks (https://www.cisecurity.org/cis-benchmarks/) * CodeQL (https://codeql.github.com/) - code analysis engine developed by GitHub to automate security checks * Заметка «Hunting for XSS with CodeQL» (https://medium.com/codex/hunting-for-xss-with-codeql-57f70763b938) * SonarQube (https://www.sonarqube.org/). Если кто-то его ещё не знает :) * “Software Bill of Materials” (SBOM) (https://www.ntia.gov/SBOM) * Yandex talk from ZeroNights "Company wide SAST" (https://www.youtube.com/watch?v=JK8uUKjo_ag) * Bandit (https://github.com/PyCQA/bandit). Helps to find common security issues in Python code * Owasp ZAP (https://medium.com/cloudadventure/security-in-a-ci-cd-pipeline-876ed8541fa4). Dynamic Application Security Testing tool (DAST) * IAST Seeker (https://www.synopsys.com/software-integrity/security-testing/interactive-application-security-testing.html) * The Docker Bench for Security (https://github.com/docker/docker-bench-security) is a script that checks for dozens of common best-practices around deploying Docker * Kube-bench (https://github.com/aquasecurity/kube-bench) - Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark * Книга «Kubernetes Security» (https://kubernetes-security.info/) * RESTler for RESP API fuzzing (https://github.com/microsoft/restler-fuzzer) * libFuzzer (https://llvm.org/docs/LibFuzzer.html) a library for coverage-guided fuzz testing * ClusterFuzz (https://google.github.io/clusterfuzz/) is a scalable fuzzing infrastructure that finds security and stability issues in software * OSS-Fuzz (https://github.com/google/oss-fuzz) - continuous fuzzing for open source softwar * Microsoft Sentinel (https://azure.microsoft.com/en-us/services/microsoft-sentinel/). Next-generation security operations with cloud and AI * Книга «Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats» (https://www.amazon.es/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164) Понравился выпуск? — Поддержи подкаст на patreon.com/KSDaemon (https://www.patreon.com/KSDaemon), звёздочками в iTunes (https://podcasts.apple.com/ru/podcast/software-development-podcast/id890468606?l=en) или своём подкаст-плеере, а так же ретвитом или постом! Заходи в телеграм-чат SDCast (https://t.me/SDCast), где можно обсудить выпуски, предложить гостей и высказать свои замечания и пожелания!

ai security helps hunting application architects checks bandits python github kubernetes cloud security xss sast just security security architect iso iec materials sbom microsoft sentinel

What's Trending in Protecting Data & the Supply Chain

RSA Conference

Play Episode Listen Later Feb 1, 2022 39:00

Protecting Data & the Supply Chain so deeply intertwined with everything from software to identity. Join Program Committee members Edna Conway and Diana Kelley as they discuss the challenges that folks are struggling with right now and some potential mitigation strategies. We'll explore what's happening with Log4j and other vulnerabilities as well as the need for a software Bill of Materials (SBOM). Speakers: Edna Conway, Vice President, Security & Risk Officer, Azure, VP, Chief Security & Risk Officer, Azure Microsoft Diana Kelley, CTO and Co-Founder, SecurityCurve Kacy Zurkus, Content Strategist, RSAC

co founders data vice president security protecting cto supply chains trending azure content strategist rsac chief security materials sbom diana kelley edna conway

software bill of materials (SBOM) (noun) [Word Notes]