Paul's Security WeeklySubscribe
Supply chain, Risk Assessments/Management

Supply Chain – PSW #811

AI generated description fun: "As the glasses are filled and the mood lightens, our veteran guests, each with a legendary tale or two tucked under their virtual belts, embark on a journey through the complex landscape of supply chain security. These old dogs share war stories, anecdotes, and hard-earned wisdom about the evolving challenges and threats that have shaped their illustrious careers. From the early days of computing to the present era of interconnected systems, our panelists delve into the intricacies of securing the supply chain. Expect insights on the timeless art of social engineering, the ever-expanding attack surface, and the unforeseen vulnerabilities that emerge when least expected."

Talking points:

  • Define the different areas of supply chains * Hardware * Firmware / Low-Level Software * Operating systems and applications * Software you develop yourself
  • Open-source software supply chains have interesting problems
  • Detecting supply chain issues
  • Who is responsible for supply chain security?
Full episode and show notes

Hosts

Principal Security Researcher at Eclypsium
Senior Vice President, Audience Content Strategy at CyberRisk Alliance
Sr. InfoSec Consultant at Online Business Sytems
Executive Director at Guardedrisk
Product Security Research and Analysis Director at Finite State
Chief Product Officer at CyberSaint

Related

AI fixes everything, C++ the actual worst, IAM is hard – ASW #308

This week, in the Application Security News, we dismiss magical thinking and discuss what generative AI will actually be able to do for us. We also discuss whether Secure by Design's goals are practical or not. OSC&R releases a report on software supply chain that should be interesting, though neither of us had time to read it yet. Also, Wat...
Exploding Pagers – PSW #843

Apple drops a lawsuit to avoid exposing secrets, what does it mean for the security industry if MS locks down the kernel?, exploding pagers, more things from the past: Adobe Flash exploits, robots get rid of your data, PKFail is still a thing, Android TV malware is back: now with conspiracy theories, DMA attacks, gamers are not nation-state attacke...
Wifi Vulns, Yubikeys, and Firmware – PSW #842

Don't tell the FCC there is a new Flipper firmware release, unpatchable?, argv[0] and sneaking past defenses, protect your registries, someone solved my UART RX problem, PKFail update, legal threats against security researchers documented, EDR bypass whack-a-mole continues, emulating PIs, VScode moonlights as a spy, Want to clone a YubiKey? All you...