Don't neutralize CI/CD business gains by failing to account for risk. Here are best practices to ensure that your software development pipeline is secure.
Read More about 8 CI/CD security best practices: Protect your software pipeline
SLSA and Sigstore are a good first step toward protecting ML models from attack. But they're not a panacea.
Read More about How supply chain security tools can protect ML models
Version 1.2.0 of ReversingLabs' TitaniumCloud v2 app for Splunk SOAR adds new actions for network reputation lookups.
Read More about TitaniumCloud app for Splunk SOAR updated
SBOMs are essential — but making them useful in CI/CD environments is tricky. Here are 5 key best practices.
Read More about 5 best practices for securing your CI/CD with software bills of materials
ReversingLabs has highlighted threats in npm, PyPI and RubyGEMS in recent years. This finding shows NuGet is equally exposed to malicious activities by threat actors.
Read More about IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations
The OpenSSF's Secure Supply Chain Consumption Framework can be used to better discover the risks of open-source components — but remediation is left for organizations to figure out later.
Read More about How mature is your open-source risk management? S2C2F helps map dependencies
Application security veterans Mark Curphey and John Viega went on a CISO listening tour. Here's what they learned.
Read More about App sec prioritization is priority No. 1 for CISOs
Extending validity checks is welcome, but secrets risk is bigger than that — and requires a holistic supply chain security approach.
Read More about GitHub boosts secrets scanning: A necessary step, but supply chain security is key to managing risk
Extending the language's bare-metal use from Linux will make Android a trusted platform — and have a broader impact on the Rust development community.
Read More about Rust on Android goes bare metal: 3 key security benefits
Here's why application programming interface security is critical to risk management — and the advances needed to move API security forward.
Read More about Are APIs the weak link in your supply chain security?
What’s to come for the security of open source software? ConversingLabs caught up with Mikaël Barbero of the Eclipse Foundation to answer that question. Watch (or listen) and learn.
Read More about The state of OSS security: Changes in attack methods, policy
ReversingLabs discovered that one “s” was all that separated a legit npm package from a malicious twin that delivered the r77 rootkit — and was downloaded more than 700 times.
Read More about Typosquatting campaign delivers r77 rootkit via npm
Version 8.3 of RL's A1000 Malware Analysis Platform delivers better visuals, search, and an improved cloud sandbox. Here are all of the updates.
Read More about ReversingLabs A1000 Threat Analysis and Hunting Solution Update Drives SecOps Forward
NIST's new guidelines are welcome, but some organizations may find it challenging to put them into practice.
Read More about NIST supply chain security guidance for CI/CD environments: What you need to know
NIST's new guidelines are welcome, but some organizations may find it challenging to put them into practice.
Read More about NIST supply chain security guidance for CI/CD environments: What you need to know