Paul's Security WeeklySubscribe
Vulnerability Management, Endpoint/Device Security, Supply chain, Risk Assessments/Management

Supply Chain & Firmware Security – Xeno Kovah – PSW #811

Full Audio

View Show Index

Segments

1. Supply Chain – PSW #811

AI generated description fun: "As the glasses are filled and the mood lightens, our veteran guests, each with a legendary tale or two tucked under their virtual belts, embark on a journey through the complex landscape of supply chain security. These old dogs share war stories, anecdotes, and hard-earned wisdom about the evolving challenges and threats that have shaped their illustrious careers. From the early days of computing to the present era of interconnected systems, our panelists delve into the intricacies of securing the supply chain. Expect insights on the timeless art of social engineering, the ever-expanding attack surface, and the unforeseen vulnerabilities that emerge when least expected."

Talking points:

  • Define the different areas of supply chains * Hardware * Firmware / Low-Level Software * Operating systems and applications * Software you develop yourself
  • Open-source software supply chains have interesting problems
  • Detecting supply chain issues
  • Who is responsible for supply chain security?

Hosts

Principal Security Researcher at Eclypsium
Senior Vice President, Audience Content Strategy at CyberRisk Alliance
Sr. InfoSec Consultant at Online Business Sytems
Executive Director at Guardedrisk
Product Security Research and Analysis Director at Finite State
Chief Product Officer at CyberSaint

2. Learning About Firmware Security – Xeno Kovah – PSW #811

Firmware security is a deeply technical topic that's hard to get started in. In this episode of Below the Surface, Xeno will discuss some past work in firmware security, and how he has organized resources such as a low level timeline (with over 300 talks), and free MOOC classes, to help teach people about firmware security.

Segment Resources: https://ost2.fyi https://darkmentor.com/timeline.html

This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!

Sponsored By

Eclypsium

Guest

Founder at OpenSecurityTraining2

Xeno began leading BIOS security research projects at MITRE in 2011. His team’s first public talks started appearing in 2013, which led to a flurry of presentations on BIOS-level vulnerabilities up through 2014. In 2015 he co-founded LegbaCore. And after presenting a firmware worm that could spread between Macs via Apple’s EFI-based BIOS and Thunderbolt Ethernet adapters, he ended up working for Apple. There he worked on securing all the lesser-known firmwares on Macs and peripherals – everything from 3rd party GPUs to SecureBoot for monitors! He worked on the x86-side of the T2 SecureBoot architecture, and his final project was leading the M1 SecureBoot architecture – being directly responsible for designing a system that could provide iOS-level security, while still allowing customer choice to trust arbitrary non-Apple code such as Linux bootloaders. He left Apple in Dec. 2020 after the M1 Macs shipped, so he could work full time on OpenSecurityTraining2.

Hosts

Principal Security Researcher at Eclypsium
Principal Cyber Strategist at Eclypsium

Related

Fortinet, Palo Alto, VMWare – PSW #852

Fast cars kill people, Apple 0-Days, memory safety, poisoning the well, babble babble and malware that tries really hard to be stealthy, Palto Alto and Fortinet have some serious new vulnerabilities, open-source isn't free, but neither is commercial software, get on the TPM bus, find URLs with stealth, stealing credentials with more Palto Alto and ...