GitHub: How Code Provenance Can Prevent Supply Chain Attacks
3 Min Read
Source: ronstik via Alamy Stock Photo
GARTNER SECURITY & RISK MANAGEMENT SUMMIT — Washington, DC — Having awareness and provenance of where the code you use comes from can be a boon to prevent supply chain attacks, according to GitHub's Jennifer Schelkopf, director of product management at GitHub.
Supply chain attacks, which occur when software is compromised and then affect that software's users downstream, are a major issue. It's an issue that has become exacerbated by threat actors targeting ubiquitous open source code, like that of Java logging framework Log4j. As Schelkopf explained in her presentation at Gartner's Security & Risk Management Summit yesterday, 45% of organizations will have experienced a supply chain attack by the end of the year.
Specific to the malicious code flavor of supply chain attack, Schelkopf referenced a number of examples of it in action, including the attack against SolarWinds discovered...
Copyright of this story solely belongs to darkreading.com. To see the full text click HERE
