PIRATEs of the Software Supply Chain.pdf
Still in the mindset that retrofitting legacy and expensive approaches like a #SIEM will solve software supply chain security problems? What about treating SBOMs as a compliance checkbox rather than translating them into REAL security? #PIRATE is an acronym that aligns threat modeling with strategic business objectives. It helps align your organization for you to lead "Project to Product Transformation." It enables you to remove manual compliance work from your developers by operationalizing the value of SBOMs into security actions. PIRATE stands for Product Integrated Risk Analytics & Threat Evaluation. Understand how the PIRATE methodology will improve the security of your ever-changing attack surface. Learn how to overcome the critical challenges of enforcing security controls with context. See how context enables accountable risk remediation in the flow of everyday work — and more.... Check the YouTube: https://www.youtube.com/watch?v=DjZSAyWuy8w&feature=youtu.be
Recommended
Recommended
More Related Content
Similar to PIRATEs of the Software Supply Chain.pdf
Similar to PIRATEs of the Software Supply Chain.pdf (20)
Recently uploaded
Recently uploaded (20)
PIRATEs of the Software Supply Chain.pdf
- 1. US 11,080,162 & 11,288,167 H o w T o O p e r a t i o n a l i z e S B O M V a l u e
- 2. 2 SBOMs: Securing Software Supply Chains Product Facts 34 unaddressed risks # of developers verified Controls Score 5 Total Issues Tech Vulnerabilities Dependency Vulnerabilities Code Weaknesses Tool Vulnerabilities API Security Issues Cloud Security Issues 6 5 7 3 8 1 4 Policy Violations 0 Threats Detected 4* *unauthorized code commit activity, unmanaged asset, prohibited tech…..
- 3. 3 Static SBOMs = A Compliance Checkbox, Not Security Agile & DevOps = Continuous Everything
- 4. 4 WHY is this important? …when both environment changes AND hacking is a constant activity. Cyber Insurance Audit / Assessors Security Engineering Software Vendors Regulators
- 5. 5 5 The Tides Have Turned Too much trust, self-attestation, and manual tracking has proven to be a losing battle. X Snapshot audit sampling, combined with legacy tools and processes is risking business. X Proactive prevention and continuous risk management is the key to winning the war.
- 6. 6 Key Challenges Leveraging Legacy Approaches, Like SIEM • SIEM aggregates alert data • Lacks correlation • To remediate... ...or go XDR • Analytics are pre-established • Minimize the need for security data analysts • Breach identification focused
- 7. 7
- 9. 10 Product Integrated • Establish measurable best practices • Define business criticality • Map data streams from attack surface components (code, APIs, services, OSS, cloud, IaC) Enabling Your Project to Product Transformation: Security Performance Automatically Prioritized To Proactively Remediate Material Risk Scoring Assurance Reporting Define Business Logic & Map Key People Product
- 10. 10 Overcoming Key Challenges ADDRESSING SOFTWARE SUPPLY CHAIN SECURITY RISK Contracting SBOMs Provenance Roles & Responsibilities Governance Monitoring & Management
- 11. 11 Security Across Entire Lifecycle, On Every Product “Shift Everywhere” Monitoring Enables Modern CM (Continuous risk assessment before and after deployment) Design Code Build Deploy Application Security Posture Operate Monitor
- 12. 12 How Contextual, Dynamic SBOMs Help Security Design Code Build SBOM Author Product Component License Vulnerabilities Created on Author Product Component License Vulnerabilities Created on Author Product Component License Vulnerabilities Created on
- 15. 15 SBOMs: Enabling Software Build & Supply Chain Hardening Search for vulnerable components with context X CVE log4j apache struts Baseline architecture and developer code </> Supply chain creation & fidelity telemetry Rules to control architecture drift risks Identifying vendors building insecure applications Detecting internal applications experiencing code rot Find applications susceptible to 0 Day exploits Minimize unexpected cloud costs, and security or compliance risks
- 16. 16 Operationalized SBOM Value Security & Compliance Producers TPRM & Contracting Consumers Cyber Insurance Confidence
- 17. US 11,080,162 & 11,288,167 jeremy@tauruseer.com alex@tauruseer.com