MYSEC.TV

Home   /   RESOURCES   /   MYSEC.TV   / Software Supply Chain Risks

Software Supply Chain Risks

Tech & Sec Weekly
SHARE:

IN THIS VIDEO

Jane Lo, Singapore Correspondent speaks with Yakir Kadkoda, Security Researcher and Ilay Goldman, Security Researcher with Aqua Security

Yakir Kadkoda combines his expertise in vulnerability research with a focus on discovering and analyzing new security threats and attack vectors in cloud native environments, supply chain security, and CI/CD processes. Prior to joining Aqua, Yakir worked as a red teamer.

Ilay Goldman specializes in discovering and analyzing novel security threats and attack vectors in cloud native environments, supply chain security, and CI/CD processes. Additionally, Ilay conducts research on open-source security and vulnerabilities. Prior to joining Aqua, he worked as a red teamer.

In this interview at Black Hat Asia, Yakir and Ilay explain the complexity of a modern software supply chain, and the dependency of a typical software development cycle on open-source code, and the wide array of tools and platforms.

They note that in this supply chain ecosystem, there are many vulnerable tools and platforms trusted by majority of developers. To highlight some examples of these vulnerabilities, Yakir and Ilay divide the development flow of many organizations into different phases – Integrated Development Environments (IDEs), Source Code Managers (SCMs), Continuous Integration/ Development (CI/CD), Package management and more.

They point out, for instance, the potential of malicious IDE extensions that may be inadvertently trusted by developers, or how threat attackers could compromise accesses to package manager platforms to impersonate malicious packages.

They also share how they found tens of thousands of tokens of open source projects that have been leaked by CI/CD platforms, which could be exploited for lateral movement.

Wrapping up, they advise that software developers practice security-by-design – that whilst “security takes time”, fixing the problem later may incur even more costs and time.

Recorded 11th May 2023, 11am, Black Hat Asia 2023, Singapore Marina Bay Sands

#BHasia #mysecuritytv #supplychain #cybersecurity

OTHER VIDEOS IN THIS SERIES

space-03
December 3, 2024
Dr Shawna Pandya is the first named Canadian female commercial astronaut, a Physician and Director of the International Institute for Astronautical Sciences Space Medicine Group. Watch Now
space-02
December 3, 2024
We welcome Australian Astronaut Katherine Bennell-Pegg back to Australia in Space TV on her first appearance at IPSEC. Watch Now
space-01
December 3, 2024
Axiom Space recently welcomed former Japan Aerospace Exploration Agency (JAXA) astronaut Koichi Wakata as a newly appointed Astronaut and Chief Technical Officer for the Asia-Pacific region. Watch Now
dragos
November 22, 2024
Are you prepared for a cyber-attack? Whether you’re managing a national or state-wide critical infrastructure organisation, or you’re a small rural provider with a lean team, the stakes are higher than ever for Australia’s Energy and Utility operators. Watch Now