Software bills of materials (SBOMs) are having their day — they're even government-mandated at times. In September 2023, the U.S. Food and Drug Administration issued its final version of “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.” The guidance corresponds to the 2023 Consolidated Appropriations Act, ... Read More

The concept of software supply chain security (SSCS) has taken center stage over the past few years in the wake of new federal policies, increases in the threats to open-source platforms, and the continuing struggles to patch critical vulnerabilities. However, one of the most under-addressed areas of SSCS is commercial ... Read More

This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) took a major step forward as it continues to define federal software supply chain security policy. “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem” serves as the official counterpart to the CISA’s landmark Secure by ... Read More

If you’re a cybersecurity professional working at any modern, connected organization that handles sensitive data and holds valuable intellectual property, the specter of a software supply chain compromise looms large.  ... Read More

See RL's Joshua Knox break down the Polyfill.io supply chain attack on YouTube ... Read More

Five years ago, we didn’t hear much about software supply chain attacks. Today, they’re commonplace. Barely a week goes by without news of malicious or compromised packages tempting developers on open-source repositories such as npm, GitHub, and Python Package Index (PyPI). But although it can seem at times that the ... Read More

The 32nd annual RSA Conference (RSAC) – one of the biggest cybersecurity shows in North America — was held in  San Francisco last week at the Moscone Center. The who's who-event was jam-packed with hundreds of vendors, speaking sessions, and all kinds of goodies ... Read More

In the span of just a few years, software supply chain security has evolved from being a niche security topic to a top priority for development organizations, security practitioners and CISOs alike. That shift is evident when you take a peek at the schedule for this year’s RSA Conference in ... Read More

The U.S. National Institute of Standards and Technology (NIST) released the first version of its Cybersecurity Framework (PDF) in 2014. It was originally designed for use by the U.S.'s critical infrastructure sectors to help them better manage cybersecurity threats. As for the enterprises and small businesses that make up the ... Read More

RSA Conference 2024 is almost here. If you’re among the thousands of security leaders heading to San Francisco this May, you'll want to manage your schedule — and filter out the noise from the hundreds of vendors and the thousands of security industry reps who will flood the Moscone Center.  ... Read More