Challenge: The software supply chain is only as strong as its weakest link. Software providers falling victim to cyber-attacks can unfortunately deliver an attacker’s payload to unsuspecting customers. Because supply chain attacks can be well obfuscated and occur after traditional source code scanning is completed, inspecting release package is the right approach for assessing whether behavior changes, software tampering and other indicators of code compromise have occurred.
Solution: ReversingLabs assesses actual software packages for attack indicators, providing a detailed audit of software components and informs users about hidden risks. This independent package analysis means validation can happen at any point along a software supply chain and can identify several types of risks that have not been easy to spot before now.
Challenge: Relying solely on a point-in-time, vendor attestation questionnaire cannot deliver the required level of insight to ensure that regularly updated applications, even from a trusted vendor, remain secure. While a check-the-box approach can flag potential problems, but it can also overlook newer exposures and risks, providing an incomplete view.
Solution: ReversingLabs validates software components and behaviors from the release package, without requiring source code or special debug builds. Thus customers, auditors, and application security teams can independently verify that software updates continue to pose an acceptable level or risk before deployment.
Solution Insights
SolarWinds compromise exploited through sophistication and patience
Several myths and misconceptions exist about third-party software
With today’s software more reliant on third-party and open-source software, your software development lifecycle (SDLC) demands more checks to validate the integrity of your build, release and production software
ReversingLabs integrates to leading Python package repository PyPI to provide greater assurances that software packages distributed from its repository are free of malware.
ReversingLabs integrates to leading software code management system GitHub to provide assurance to organizations that their private repositories used during the software development and release processes are free of malware.
ReversingLabs integrates to leading JavaScript and node.js package manager npm to provide greater assurances that the distribution of JavaScript packages and modules are free of malware.
