Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
In February, the National Institute of Standards and Technology released guidelines for secure software development, meeting a deadline established by President Biden’s May Executive Order on Improving the Nation’s Cybersecurity.
The new guidelines, embodied in NIST publication SP 800-218, outline the obligations that producers of commercial off-the-shelf (COTS) and government off-the-shelf (GOTS) software have if they are licensing software or services to federal agencies.
Get a free SBOM and full supply chain risk analysis report
The guidance includes things like following secure software development practices; collecting, maintaining, and sharing provenance data for all software components; and tracking software dependencies. Software producers are also urged to check their code for backdoors and other malicious content - a clear reference to the now infamous compromise of SolarWinds, which affected a number of sensitive Federal agencies. (For more on SolarWinds, read our blog post: "Sunburst: the next level of stealth")
What does NIST’s new Secure Software Development Framework (SSDF) mean for software firms and their customers? And how can companies begin to wrap their arms around the new guidelines from Uncle Sam?
To get answers to those questions and others, we sat down with Tomislav Peričin, the Chief Software Architect at ReversingLabs for a chat. In this video chat, recorded just after the NIST guidance was published, Tomislav and host Paul Roberts dig into the details of the new NIST framework. They also talk about emerging federal requirements for software producers to maintain so-called Software Bills of Materials (SBOMs) that provide an ingredient list for software and services used in federal agencies.
Check out their conversation below!
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.
The post-mortems of two compromises by rogue AI agents show that security teams need to focus on guardrails, not the AI model.
Research into an Active Directory takeover with a single AI prompt highlights why organizations need to focus on agentic SOCs.