How to operationalize software bills of materials for incident response
Here's why SBOMs are essential for cybersecurity incident response — and how to put them to work.
How to operationalize software bills of materials for incident response
RSAC in review: Supply chain security, cyber war and AI
The stakes were raised at RSA Conference 2023: A “hot” cyber war in Ukraine, software supply chain attacks on the rise — and let's not forget about artificial intelligence.
CISA Secure by Design: 'It's a starting point, not an endpoint'
Here's what experts say about the CISA initiative's potential impact on software supply chain security — and security operations.
The rise of malware in the software supply chain – and what to do about it
In a ConversingLabs conversation, Charlie Jones of ReversingLabs talks about risk with supply chain attacks, and what development teams can do to spot malware lurking in signed code.
The Week in Security: A possible Colonial Pipeline 2.0, ransomware takes bite out of American eateries
Welcome to the latest edition of The Week in Security, which brings you the newest headlines from both the world and our team across the full stack of security: application security, cybersecurity, and beyond.
Package names repurposed to push malware on PyPI
What’s in a name? Here's how bad actors are pushing malware on the Python Package Index under the guise of legitimate yet abandoned open source modules.
What traditional app sec tools miss: The monsters in your software supply chain
Matt Rose presents at RSAC 2023 on the mismatch between traditional app sec tools like SCA and modern supply chain threats. Here are highlights from his talk.
The 3CX attack gets wilder, marks first 'cascading supply chain compromise'
The surprising story of the hack of VoIP provider 3CX got even crazier this week. Here's what you need to know.
Companies scramble to cover software supply chain security gaps: 3 key survey takeaways
In a new ReversingLabs Software Supply Chain Risk Survey, IT pros say supply chain security poses an “enterprise-wide” risk that traditional app sec tools can't address.
The Week in Security: 3CX attack caused by earlier supply chain hack, malware in Google Play
One software supply chain attack caused another, making it a first for the industry. Also: Malware spreads via apps in the Google Play Store.
What’s hot at RSA Conference 2023: 8 must-see software supply chain security talks
Software supply chain security is taking center-stage at RSAC 2023. Here are the talks you don't want to miss.
Secrets security: The why, the how – and what to do about it
Secrets are increasingly exposed during software development, creating a field-day for malicious actors. Here are key takeaways from our special report series, Secrets Exposed.
EU cyber laws ‘will’ make FOSS devs liable
The Python Software Foundation is very, very unhappy with the draft Cyber Resilience Act (CRA) and Product Liability Act (PLA).
What’s hot at RSA Conference 2023: 6 must-see malware analysis and threat hunting talks
There is so much to take in at RSAC. Cut through the noise with our list of threat-focused talks you don't want to miss.
OSC&R embraces GitHub: Will it move the needle on supply chain security?
Here's what the Open Software Supply Chain Attack Reference (OSC&R) framework move means in the short run — and long term.