Blog | ReversingLabs | John P. Mello Jr. (4)

March 6, 2024

NIST CSF 2.0: Better risk management for the new era of supply chain security

NIST's Cybersecurity Framework 2.0 has been released, complete with a new focus on software supply chain security. Here are key takeaways for your team.

March 5, 2024

NIST updates supply chain guidance: 3 ways to pump up your CI/CD security

The National Institute of Standards and Technology has beefed up its guidelines for securing CI/CD environments. Are you ready to bulk up your program?

February 29, 2024

All SBOMs are not created equal: What's required for them to be effective

Here are key challenges with SBOMs, how tools affect their usefulness — and what it will take to make them effective at software supply chain security.

February 27, 2024

Lessons in threat modeling: How attack trees can deliver AppSec by design

Here's what development and application security teams need to know about using attack trees in tandem with threat modeling to lock down their software.

February 15, 2024

5 key takeaways from ESG's software supply chain complexity report

A new report from Enterprise Strategy Group highlights key challenges stemming from the complexity of modern software development. Here are key takeaways.

February 14, 2024

5 notable supply chain compromises

2023 was a big year for software security. Here are the key lessons from last year's major attacks to learn from.

February 8, 2024

OWASP Top 10 for LLM 2.0: 3 key AppSec focus areas emerge

A survey of practitioners drove key areas of focus for the vulnerability list for AI models: data privacy, safety and bias, and mapping of vulnerabilities.

January 9, 2024

Zoom joins the vulnerability fray: Will VISS move the needle on AppSec?

Here's what you need to know about Zoom's Vulnerability Impact Scoring System, how it compares to EPSS — and how it can advance your application security.

January 2, 2024

Key reasons third-party risk management programs fail

Here's why organizations are struggling with third-party risk management — and how to develop an effective program.

December 21, 2023

The JetBrains TeamCity software supply chain attack: Lessons learned

The TeamCity incident is similar to SunBurst, which was behind the attack on SolarWinds. But there are differences. Here are lessons learned, to help secure your pipeline.

December 14, 2023

The Hugging Face API token breach: 5 lessons learned

More than 1,500 tokens were exposed, leaving millions of AI models and datasets vulnerable. Here's what your security team can learn from the compromise.

December 13, 2023

Secure AI development guidance: What software teams need to know

U.K. and U.S. cyber-watchdogs say to start with Secure by Design — but don't stop there. Here are key takeaways from their new guidelines.

Software Supply Chain Security

File Security

Security Operations

Products

Technology

Partners

Alliances

Resources

Company

Events

Press