Episode Transcript
MATT ROSE: Hi, everyone. Welcome back to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs. Today's episode of ReversingGlass is Vulns versus Malware. And this is a conversation I hear a lot, especially when it relates to software supply chain security. Let's start on the left side because that's where Vulns are.
Vulns are vulnerabilities in your application. And when you think about vulnerabilities, you're thinking about an issue like, uh, XSS, XSS, sorry, or a SQL Injection, so cross site scripting or SQL Injection. When a developer or a third party organization develops a piece of software, they write it to do a functional spec.
And within writing the software, sometimes mistakes are made, and vulnerabilities are introduced into the code base. And, SQL Injection, cross site scripting, vulnerabilities that are people, hopefully, are very familiar with, but really what it is, is going outside the bounds of the intended purpose.
There was a... Activity that was designed as part of the software, maybe it's I log in, I view some records, I delete some records, I change some records, I log out. That's the functionality of the application. But based on insecure coding practices, improper sanitization, for example, there could be vulnerabilities like a SQL injection or cross site scripting looking for script tags or single quotes for a SQL injection type of vulnerability. Most of the solutions we're talking about out there today in terms of application security testing solutions are looking for vulnerabilities they're looking for things that are just an application or a piece of software isn't supposed to do and there's security risk: PII data, sensitive information, secrets leakage, those type of things.
Malware on the other side of the equation is short for malicious software. And guess what? Goodware is good software. So malicious software. And what malicious software is, it is written... And designed to do a nefarious act. The whole purpose of malware is to do something to compromise your application, your piece of software, insert a functionality that is not supposed to be there.
So the whole design of malware is to do something specific in a nefarious way. Vulnerabilities, on the other hand, are issues in the code that aren't supposed to be there, but just happened without, again, I mentioned proper sanitization, or, escalation of privileges, those type of things. So, as you do that investigation in software supply chain security, and all these vendors that are saying they're doing it, most of them are more on malware side, not the malware side but on the vulnerability side, where malware's intended purpose is to just be bad or malicious software.
Food for thought. Vulns and malware, two issues that you got to address, but they are two different beasts to attack. I'm Matt Rose. Have a great day, everybody.
Field CISO at ReversingLabs. Matt Rose has an extensive background in application security, object-oriented programming, multi-tier architecture design and implementation, and internet/intranet development. His areas of expertise include Application Security, SAST, DAST, IAST, SCA, DevSecOps, and Threat Modeling. Matt is an accomplished public speaker and has been quoted in 50+ AST industry media publications.
