In this episode of ReversingGlass, Matt Rose compares comprehensive software supply chain security to Russian Matryoshka dolls to showcase the several layers within software that need to be tested for malicious and vulnerable components.  

Learn More

• Glossary: What is Binary Analysis?
• Blog: Developers behaving badly: Why holistic AppSec is key
• Blog: The Power of Complex Binary Analysis
• Webinar: Static Analysis vs Static Binary Analysis

Episode Transcript

MATT ROSE:: Hi, everyone. Welcome back to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs and your host for these sessions, but you probably already figured that out. So today's episode, we're going to talk about binary analysis for SSCS. I've had a lot of conversations and questions around binary analysis for software supply chain, not really following how is that a benefit? We're going to start off with kind of a silly analogy here. So how many people are familiar, and I'm a terrible artist, with the Russian Matryoshka dolls, the stacking dolls that fit inside each other. So we have number one doll and then number two doll fits in, and this one's sad.

And then number three doll that's boring. And then number four doll, which is upset. They look like, I don't know the munchkins or something like that from - remember the old grimace or the munchkins from McDonald's. But this is the concept. There's a doll inside a doll.

And what this equals is, from concept, your software package. That thing that you're trying to develop. Either you're outsourcing or you're developing in house. The way in software to break apart the Matryoshka dolls like you would as a kid taking things apart, is to use binary analysis to take this package and break it up into a bunch of little packages.