Software Supply Chain Framework OSC&R Created to Help Mitigate Security Threats
Summary
Hiroki Suezawa, Senior Security Engineer at GitLab, shares that: The framework is divided into nine areas of importance defining the pipeline bill of materials (PBOM). For example, at the intersection of Open Source Security and Initial Access are TTPs including repojacking, typosquatting, malicious IDE extension, and vulnerable CI/CD templates. Recent attacks include malicious packages on the PyPi registry, which as reported by Sergio De Simone for InfoQ "can install the Meterpreter trojan disguised as pip, delete the netstat system utility, and tamper with SSH authorized_keys file." As noted by Dan Lorenc, CEO at Chainguard, "OpenVEX is complementary to SBOMs, allowing suppliers to communicate precise metadata about the vulnerability status of products directly to consumers and end users." Reaction to the release was mixed with Nermin S., Lead Solution Strategist at Immersive Labs, wondering "BUT, [does] this industry really need more frameworks?