Enhancing CVE Identification using the Contextual Analysis attacks & Detection and Prevention of malicious packages @ Supply Chain Security Meetup Meetup
6月 24, 2022
2 min read
Open-source vulnerabilities are in many applications. While finding them is critical, even more, critical is remediating them as fast as possible.
Securing your software supply chain is absolutely critical as attackers are getting more sophisticated in their ability to infect software at all stages of the development lifecycle, as seen with Log4j and Solarwinds.
Hear from industry experts at our upcoming Meetup to learn more about 3rd party vulnerabilities, threat research on real data, Red Teaming of your software supply chain, and CVE Identification and Contextual Analysis.
Talk Start Times:
– 00:12
3rd party vulnerabilities through DNS – Chen Arie (Enso.security)
– 37:56
Detection and Prevention of malicious packages and attacks
Jonathan Sar Shalom, Director of Threat Research @JFrog
Securing your software supply chain is absolutely critical as attackers are getting more sophisticated in their ability to infect software at all stages of the development lifecycle. This webinar, hosted by JFrog Director of Threat Research Jonathan Sar Shalom, will be a technical showcase of the different types of malicious packages that are prevalent today in the PyPI (Python) and npm (Node.js) package repositories. All examples shown in the webinar will be based on real data and malicious packages that were identified and disclosed by the JFrog security research team.
We will dive into:
- The types of attacks and types of payloads contained in these malicious packages
- Explain how these malicious packages can be identified and rejected
- Best practices for a secure development workflow and relevant OSS tools to use
– 1:12:23
Red Teaming – Uriel Kosayev (ABInBev)
– 1:41:40
Enhancing CVE Identification using the Contextual Analysis – Shachar Menashe (JFrog)
Speakers
Shachar Menashe
| Shachar Menashe is the Sr. Director Security Research at JFrog. He has more than 15 years of experience in security research & engineering, including low-level R&D, reverse engineering and vulnerability research. He currently leads the security research division in JFrog, specializing in automated vulnerability research techniques. Before joining Vdoo and JFrog, Shachar was responsible for building the low-level security of Magic Leap’s custom OS. Shachar holds a BSc in Electronics Engineering and Computer Science from Tel-Aviv University. |
Jonathan Sar Shalom
