As threat actors increase their focus on the exploitation of application weaknesses and the Software Supply Chain, organizations are left wondering what really is inside of their third party applications. With the shift to rapid release cycles, developers rely heavily on third-party open source code and the praxis of "build once, use many" components. Many times these components get years of use without any updates or revisions. As everyone knows within the golden proverbs of Information Technology, if something isn't broken, then don't touch it. However, for much of the software in use these components have been ignored and continually reused without considering what exposures and vulnerabilities they possess that were unknown when they were originally built. Simply put, many of our applications are rotting from within and leaving customers at risk to legacy exposures. Industry change will come from the customers demanding better visibility and holding their third party vendors accountable for the SDLC practices they maintain.
SPEAKERS:
Chuck McWhirter, Solutions Architect, ReversingLabs
Chuck has over twenty-seven years of experience in cybersecurity and solution architecture. He has a bachelor’s degree in management information systems and has held the CISSP certification since May 2000. At ReversingLabs, Chuck is responsible for consulting with RL’s largest and most complex prospective customers to validate the benefits of RL’s solutions within their technology ecosystem. Through his two and one-half decades of experience, Chuck has a deep understanding of the security industry, ranging from malware analysis, threat hunting and application security (RL), endpoint security (McAfee), and security operations and incident management (AFCERT, Atos Origin, ArcSight) domains. His contributions focus on maximizing the benefits and proper alignment of RL solutions to customer’s technical and business needs.