Generic filters

MYSEC.TV

Home   /   RESOURCES   /   MYSEC.TV   / Software Supply Chain Risks

Software Supply Chain Risks

Tech & Sec Weekly
SHARE:

IN THIS VIDEO

Jane Lo, Singapore Correspondent speaks with Yakir Kadkoda, Security Researcher and Ilay Goldman, Security Researcher with Aqua Security

Yakir Kadkoda combines his expertise in vulnerability research with a focus on discovering and analyzing new security threats and attack vectors in cloud native environments, supply chain security, and CI/CD processes. Prior to joining Aqua, Yakir worked as a red teamer.

Ilay Goldman specializes in discovering and analyzing novel security threats and attack vectors in cloud native environments, supply chain security, and CI/CD processes. Additionally, Ilay conducts research on open-source security and vulnerabilities. Prior to joining Aqua, he worked as a red teamer.

In this interview at Black Hat Asia, Yakir and Ilay explain the complexity of a modern software supply chain, and the dependency of a typical software development cycle on open-source code, and the wide array of tools and platforms.

They note that in this supply chain ecosystem, there are many vulnerable tools and platforms trusted by majority of developers. To highlight some examples of these vulnerabilities, Yakir and Ilay divide the development flow of many organizations into different phases – Integrated Development Environments (IDEs), Source Code Managers (SCMs), Continuous Integration/ Development (CI/CD), Package management and more.

They point out, for instance, the potential of malicious IDE extensions that may be inadvertently trusted by developers, or how threat attackers could compromise accesses to package manager platforms to impersonate malicious packages.

They also share how they found tens of thousands of tokens of open source projects that have been leaked by CI/CD platforms, which could be exploited for lateral movement.

Wrapping up, they advise that software developers practice security-by-design – that whilst “security takes time”, fixing the problem later may incur even more costs and time.

Recorded 11th May 2023, 11am, Black Hat Asia 2023, Singapore Marina Bay Sands

#BHasia #mysecuritytv #supplychain #cybersecurity

OTHER VIDEOS IN THIS SERIES

ch_tile-03
December 11, 2023
We speak with Jason Price, President and CEO for Australia & New Zealand for NEC Corporation at the Canalys Channel Forum APAC 2023 in Bangkok, a hub for industry leaders and innovators. Price provided insights into NEC Australia’s diverse portfolio and the organization’s approach to staying ahead in the ever-evolving technology landscape. Watch Now
ch_tile-02
December 11, 2023
We speak with Thomas Crisp, founder and CTO of Cyber Sentience, a cybersecurity company based in New Zealand, attending the Canalys Channel Forum APAC 2023 in Bangkok. Watch Now
ch_tile-01
December 11, 2023
We speak with Pranay Anand, Vice President of Technology Solutions at NTT, and his insights into the exciting world of technology and innovation at Canalys Channel Forum APAC 2023 in Bangkok. Watch Now
sp_tile-01
December 11, 2023
Attending the 16th Australian Space Forum in Sydney this week, Dr Paul Bate, the Chief Executive of the UK Space Agency, discussed the burgeoning collaboration between the United Kingdom and Australia under the banner of the “Space Bridge.” The initiative aims to foster joint efforts between the two nations in space exploration, regulation, and industry development. Watch Now