<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1076912843267184&amp;ev=PageView&amp;noscript=1">

Software Supply Chain Security: The Differences Between Vulnerabilities and Malware

August 3, 2023

In this episode of ReversingGlass, Matt explains the key differences behind two major threats to software supply chains: vulnerabilities and malware. He demonstrates how vulnerabilities are unintentional risks, while malware is an intentionally nefarious action. 

Learn More

- See post: 6 reasons app sec teams should shift gears and go beyond vulnerabilities
- ReversingGlass: The DNA of Software Supply Chain Security
- Report: The Software Supply Chain Risk Report

Episode Transcript

MATT ROSE: Hi, everyone. Welcome back to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs. Today's episode of ReversingGlass is Vulns versus Malware. And this is a conversation I hear a lot, especially when it relates to software supply chain security. Let's start on the left side because that's where Vulns are.

Vulns are vulnerabilities in your application. And when you think about vulnerabilities, you're thinking about an issue like, uh, XSS, XSS, sorry, or a SQL Injection, so cross site scripting or SQL Injection. When a developer or a third party organization develops a piece of software, they write it to do a functional spec.

And within writing the software, sometimes mistakes are made, and vulnerabilities are introduced into the code base. And, SQL Injection, cross site scripting, vulnerabilities that are people, hopefully, are very familiar with, but really what it is, is going outside the bounds of the intended purpose.

There was a... Activity that was designed as part of the software, maybe it's I log in, I view some records, I delete some records, I change some records, I log out. That's the functionality of the application. But based on insecure coding practices, improper sanitization, for example, there could be vulnerabilities like a SQL injection or cross site scripting looking for script tags or single quotes for a SQL injection type of vulnerability. Most of the solutions we're talking about out there today in terms of application security testing solutions are looking for vulnerabilities they're looking for things that are just an application or a piece of software isn't supposed to do and there's security risk: PII data, sensitive information, secrets leakage, those type of things.

Malware on the other side of the equation is short for malicious software. And guess what? Goodware is good software. So malicious software. And what malicious software is, it is written... And designed to do a nefarious act. The whole purpose of malware is to do something to compromise your application, your piece of software, insert a functionality that is not supposed to be there.

So the whole design of malware is to do something specific in a nefarious way. Vulnerabilities, on the other hand, are issues in the code that aren't supposed to be there, but just happened without, again, I mentioned proper sanitization, or, escalation of privileges, those type of things. So, as you do that investigation in software supply chain security, and all these vendors that are saying they're doing it, most of them are more on malware side, not the malware side but on the vulnerability side, where malware's intended purpose is to just be bad or malicious software.

Food for thought. Vulns and malware, two issues that you got to address, but they are two different beasts to attack. I'm Matt Rose. Have a great day, everybody.

Matt Rose

About Author: Matt Rose

Field CISO at ReversingLabs. Matt Rose has an extensive background in application security, object-oriented programming, multi-tier architecture design and implementation, and internet/intranet development. His areas of expertise include Application Security, SAST, DAST, IAST, SCA, DevSecOps, and Threat Modeling. Matt is an accomplished public speaker and has been quoted in 50+ AST industry media publications.

Related episodes

Artificial Intelligence (AI)/Machine Learning (ML)

ReversingGlass: EO on AI: What security teams need to know


Shift Up Your SBOM


Who is ReversingLabs?

Artificial Intelligence (AI)/Machine Learning (ML)

AI and Software Supply Chain Security: Proceed with Caution


What the heck is an SBOM?


What is ReversingGlass?


Sign up now to receive the latest weekly
news from ReversingLabs

Get Started
Request a DEMO

Learn more about how ReversingLabs can help your company reduce attack surface risks with deep software and file threat analysis to speed release and response.