Le Lézard
Classified in: Science and technology
Subject: PDT

Cybersecurity Leaders Launch First Attack Matrix for Software Supply Chain Security

Current and former cybersecurity leaders from Microsoft, Google, GitLab, Check Point, OWASP, Fortinet and others have already joined the open framework initiative, which is being led by OX Security.

TEL AVIV, Israel, Feb. 1, 2023 /PRNewswire/ -- OX Security, the first end-to-end software supply chain security solution, today announced the launch of OSC&R (Open Software Supply Chain Attack Reference), the first and only open framework for understanding and evaluating existing threats to entire software supply chain security.

The founding consortium of cybersecurity leaders behind OSC&R include: David Cross, former Microsoft and Google cloud security executive; Neatsun Ziv, Co-Founder and CEO of OX Security; Lior Arzi, Co-Founder and CPO at OX Security; Hiroki Suezawa, Senior Security Engineer at GitLab; Eyal Paz, Head of Research at OX Security; Phil Quade, former CISO at Fortinet; Dr. Chenxi Wang, former OWASP Global Board member; Shai Sivan, CISO at Kaltura; Naor Penso, Head of Product Security at FICO; and Roy Feintuch, former Cloud CTO at Check Point Technologies.

Discussions with hundreds of industry leaders revealed that there was a very concrete need for a MITRE-like framework that would allow experts to better understand and measure supply chain risk, a process that until now could only be  based on intuition and experience. OSC&R is designed to provide a common language  and structure for understanding and analyzing the tactics, techniques, and procedures (TTPs) used by adversaries to compromise the security of software supply chains.

"Trying to talk about supply chain security without a common understanding of what constitutes the software supply chain isn't productive," said Neatsun Ziv, who served as Check Point's VP of Cyber Security before founding OX. "Without an agreed-upon definition of the software supply chain, security strategies are often siloed."

OSC&R is now ready to be used by security teams to evaluate existing defenses and define which threats need to be prioritized, how existing coverage addresses those threats, as well as to help track behaviors of attacker groups.

"OSC&R helps security teams build their security strategy with confidence," said Hiroki Suezawa, Senior Security Engineer at Gitlab. "We wanted to give the security community a single point of reference to proactively assess their own strategies for securing their software supply chains and to compare solutions," he continued.

The OSC&R framework will update as new tactics and techniques emerge and evolve. It will also assist red-teaming activities by helping set the scope required for a pentest or a red team exercise, serving as a scorecard both during and after the test. The framework will also now be open for other cybersecurity leaders and practitioners to contribute to OSC&R.

"I believe the OSC&R framework will help organizations reduce their attack surface," said Naor Penso, Head of Product Security at FICO. "I am proud to take part in a project that can have such a major impact on the future security landscape, and to share our knowledge and expertise."

The OSC&R framework is now online: https://pbom.dev/

About OX Security

OX Security believes that security should be an integral part of the software development process, not an afterthought. Founded by Neatsun Ziv and Lior Arzi, who previously led Check Point's Security Group, OX  is the first end-to-end software supply chain security solution. OX provides DevSecOps teams with the automation, visibility, and risk insights they need to bring security and integrity to every step of the supply chain, from the earliest planning stages until deployment to production.

SOURCE Ox Security

These press releases may also interest you

at 18:32
OUTFRONT Media  shows its support for its home city through the Partnership for New York City's new "We ? NYC " citywide civic action campaign. Geared to inspiring New York City's post-pandemic resurgence, the campaign is showcasing the city's...

at 18:31
ThermoGenesis Holdings, Inc. , a market leader in automated cell processing tools and services in the cell and gene therapy field, today announced the closing of its previously announced purchase and sale of 1,071,429 shares of its common stock (or...

at 18:15
The "Israel Social Commerce Market Intelligence and Future Growth Dynamics Databook - 50+ KPIs on Social Commerce Trends by End-Use Sectors, Operational KPIs, Retail Product Dynamics, and Consumer Demographics - Q1 2023 Update" report has been added...

at 18:15
The News/Media Alliance applauds California State Assemblymember Buffy Wicks (D-Oakland) for today introducing the California...

at 18:05
DocuSign, Inc. , announced that Cynthia Gaylor, DocuSign's Chief Financial Officer, is scheduled to participate in the following investor event. Morgan Stanley 2023 Silicon Valley Software Bus TourMonday, April 3, 202311:30 a.m. PST (2:30 p.m....

at 18:04
NexGen Virtual announces additional features in the NexGen Virtual Office App for Webex by Cisco, a leading provider of collaboration technologies powering hybrid work, on the Webex App Hub. NexGen Virtual, available on the Webex App Hub, enables...

News published on 1 february 2023 at 15:00 and distributed by: