Software Supply Chain Attacks: How vs. What

In this episode, ReversingLabs Field CISO Matt Rose explains why it's key for teams to understand the process by which supply chain attacks happen — and the results of those attacks.

Learn more

-Blog: 10 software supply chain attacks you can learn from
-Blog: Supply chain security: Is technical debt weighing your team down?
-Related ReversingGlass: Application Hacks vs. Software Supply Chain Hacks

Episode Transcript

MATT ROSE: Hi everyone, welcome to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs. Today's episode is "How versus What," and what I mean by that is how are software supply chain attacks happening versus what are they? And that may seem a little confusing up front, but when you think about software supply chain attacks, it's typically around malware.

And finding malware within a package, within an open source package, a complete piece of software. But I want to put a little different lens on it to have a complete approach to software supply chain security. And just like I always do, I want to put a little color commentary, a little obscurity in here.

You're probably wondering what the heck I'm doing here, but this is what I'm doing right now. So I always want to use some pop culture references. The obscurer, the better. So I don't know if people are familiar with The Watchmen. One of the characters in The Watchmen was Dr. Manhattan. His real name was John Osterman, Dr. John Osterman. He was an atomic physicist that had a lab accident and morphed into this omnipotent being of Dr. Manhattan, the big blue guy over here. So again, crazy analogies. But this, over this side, is the "How." And this is the "What." So thinking about this, this is how this happened. This is how John Osterman became Dr. Manhattan, which is the "What" and we're going to do a little mapping here where How versus What, which is up here. So how is gamma radiation was the whole atomic accident was Dr. Manhattan, but this is where from a software supply chain lens, the how of malware compromising your applications is through tampering,

secrets manipulation. So you basically allowing people to check things in. Unknown changes and being able to identify unknown changes via Diffs of one release to the other, seeing what's changed. And then even having that holistic approach to understanding everything's in there, all the ingredients,