Stolen keys allow bootkits to avoid Intel’s “Guard” features. And there’s no way to revoke them.
Read More about Lessons from MSI's UEFI key breach: How safe are the secrets in your software?
The path to success for SBOMs faces many hurdles. Here are key factors that threaten your investments.
Read More about 7 obstacles to success with software bills of materials
...
Read More about The Week in Security: Coalition takes down Russia's Snake espionage tool, GitHub plugs API leaks
In this ConversingLabs Cafe interview, Josh Corman, founder of I Am The Cavalry, talks about what’s behind industry skepticism around SBOMs.
Read More about Why fear rules when it comes to software bills of materials
OpenSSF's updated framework is an essential tool for dev teams, but experts say it's incomplete as a supply chain security solution
Read More about SLSA 1.0 delivers build provenance: What application security teams need to know
Welcome to the latest edition of The Week in Security, which brings you the newest headlines from both the world and our team across the full stack of security: application security, cybersecurity, and beyond.
Read More about The Week in Security: Sunburst attack set off alarms for months before discovery
The Department of Justice stays on the down-low: Poster child for software supply chain security? The plot thickens...
Read More about SolarWinds hack: Did DOJ know 6 months earlier?
Here's why SBOMs are essential for cybersecurity incident response — and how to put them to work.
Read More about How to operationalize software bills of materials for incident response
The stakes were raised at RSA Conference 2023: A “hot” cyber war in Ukraine, software supply chain attacks on the rise — and let's not forget about artificial intelligence.
Read More about RSAC in review: Supply chain security, cyber war and AI
Here's what experts say about the CISA initiative's potential impact on software supply chain security — and security operations.
Read More about CISA Secure by Design: 'It's a starting point, not an endpoint'
In a ConversingLabs conversation, Charlie Jones of ReversingLabs talks about risk with supply chain attacks, and what development teams can do to spot malware lurking in signed code.
Read More about The rise of malware in the software supply chain – and what to do about it
Matt Rose presents at RSAC 2023 on the mismatch between traditional app sec tools like SCA and modern supply chain threats. Here are highlights from his talk.
Read More about What traditional app sec tools miss: The monsters in your software supply chain
The surprising story of the hack of VoIP provider 3CX got even crazier this week. Here's what you need to know.
Read More about The 3CX attack gets wilder, marks first 'cascading supply chain compromise'
In a new ReversingLabs Software Supply Chain Risk Survey, IT pros say supply chain security poses an “enterprise-wide” risk that traditional app sec tools can't address.
Read More about Companies scramble to cover software supply chain security gaps: 3 key survey takeaways
One software supply chain attack caused another, making it a first for the industry. Also: Malware spreads via apps in the Google Play Store.
Read More about The Week in Security: 3CX attack caused by earlier supply chain hack, malware in Google Play