The Elephant in the Pipeline: Securing the Wild, Untamed Software Supply Chain - Pete ... - ESW #348

We've seen general users targeted with phishing, financial employees targeted for BEC scams, and engineers targeted for access to infrastructure. The truly scary attacks, however, are the indirect ones that are automated. The threats that come in via software updates, or trusted connections with third parties.

The software supply chain is both absolutely essential, and fragile. A single developer pulling a tiny library out of NPM can cause chaos. A popular open source project changing hands could instantly give access …

access attacks automated bec bec scams elephant employees engineers financial general infrastructure phishing pipeline scams scary software software supply chain software updates supply supply chain threats updates