Supply Chain Attacks

Software apps today are a hodgepodge of libraries, software development kits, and third party code, all stitched together like Frankenstein’s monster. Furthermore, software developers use common tools to create and deploy this software. The bad guys have figured out that by compromising one of these third party components or the tools used to create the products, they can instantly infect hundreds or thousands of products that all share the same underlying resources. This is a supply chain attack. Today we’ll discuss these single points of failure, how to identify them ahead of time and try to prevent these sorts of attacks with Cassie Crossley, CEO and co-founder of VulNow.

Interview Notes

Cassie Crossley: https://www.linkedin.com/in/cassiecrossley/

VulNow company website: https://vul.now/

VulNow’s Pre-CVE database: https://precve.vulnow.com/

CyBeats company website: https://www.cybeats.com/

Software Supply Chain Security (book): https://www.oreilly.com/library/view/software-supply-chain/9781098133696/

Proton blog on supply chain security: https://proton.me/business/blog/supply-chain-attack

Malus AI re-write tool: https://www.404media.co/this-ai-tool-rips-off-open-source-software-without-violating-copyright/

xkcd on Dependency: https://xkcd.com/2347/

Updated dependency diagram: https://www.grc.com/SN/1078.jpg

Further Info