Matt Rose, ReversingLabs | RSA Conference 2023

This is texturung TV. Everybody welcome back. We are here at rsac California San Francisco 2023 all of the above.

It's RS AC. We're back in person. It's live in it's hoping kind of back to pre-covid.

I don't know almost it seems like pretty normal to me. We're getting there. Yeah pretty normal.

We've been talking with great people great conversations. Lots of interesting things and I have the the pleasure being joined by Matt Rose. Matt is feel siso with reversing Labs.

Oh, thank you for having me. Welcome. Good to have you here.

Would you introduce yourself? And for folks that might not know about reversing Labs tell a little bit about what you do. Sure.

Absolutely my name again, Matt Rose pretty simplistic right there, but I am basically responsible for helping organizations, Define and Implement software supply chain programs that focus on really unique things like malware. Question behaviors Secrets identification and prioritization and my background has been an app. So I've been doing it, you know, unfortunately not maybe unfortunately 20 years.

So a lot of stories a lot of different things I've seen over the years. I've seen a definite Evolution Evolution or kind of change in the way software's developed and everybody knows we've gone from waterfall to more Agile development have new types of implementation for software supply chain and development practices. And really this is all kind of culminated in this new lens of risk called software supply chain, isn't it?

Amazing? You can spend a career working in a domain and suddenly it's a product category or industry. Oh, absolutely.

You're like, I've been doing that the whole time we call it that absolutely absolutely it's fun. Well, so I'm I'm curious to get your take then. Abstract software supply chain security.

I mean, we're it's come on come in to Vogue not Vogue. This we can topical because that's important. Right why suddenly are we talking about it at RSA?

I wish we would have talked about a five years ago. But why this year I think that there has been some major breaches that has happened that is really opened people's eyes. I mean a hacks breeches, whatever you want to call them that happened have a you know, very short shelf life in terms of attention.

But when it's a major breach, it does get a reputation. It does get a kind of historic lore Associated to it. And I think the solar winds attack really started that process one of the things that you know, I always like to say that technology is like science imitating life and what it's doing is it's constantly the way software is constantly being developed in a very modern devops program is very fluid and it's also very complex and one of the things that I think the nefarious people or nation state attackers are seeing that hey I can try and attack you and me and everybody else at RSA individually to get your pii data or to potentially steal some credentials from And that's arduous.

It takes a long time to go one by one. What if you go to the source of the software itself and compromise the software and let normal distribution channels handle the the spread of said infected software. So it's actually much more.

I I kind of effective in terms of just compromising the software than trying to compromise an individual. In a way the attackers have shifted farther left than we have right but way back up into this life for open source and other parts of supply chain. Yeah, absolutely interesting way to look at it.

What kind of conversations are you having with customers? Well, I think the first thing we have to do is as an industry and this is we're starting to make a lot of progress in this is what is the definition of software supply chain. Security software supply chain security the whole thing and I think that's still being defined it again.

If you walk the floor at RSA or listen to the talks, there's two terms that are both related to software supply chain security that are popping up all over the place, which is the phrase software supply chain security and s-pong. So what is software supply chain security to you people say hey we do that too. And it's it's much bigger than kind of the way people are trying to Define it.

They're trying to Define it by just looking at the parts not the whole so the open source code the Homegrown code the third party code Secrets, but it's really got to think about malware malware is one of the major issues is the major issue with software supply chain. The question is, how do they get in there? How did it actually get into the supply chain and compromise a deliverable piece of software and there's many different ways.

We think about the recent breaches that have happened with software supply chain. You have all sorts of ways to insert the malware you have the solar winds attack, which was an MS build compromise you have 3cx which was a compromise of assigned package you had a code Cove which is basically a compromise of an end user's laptop to gain access to the system. There's so many different ways to actually do this.

That people just looking at the open source code or the code repo or the binary repo is only looking at a small part of the greater complexity of that compiled and Deployable package. It's pretty broad attack surface. That's only a one set of attack.

I mean if you if you secure the pipeline, that's great. Everyone should pipeline. You've secure the open source packages and make sure that they're there's no CVS or no issues or malware in the open source packages the code itself, but that takes a lot of work and it takes a lot of steps kind of like, you know, the hackers attempting to compromise the software and let the distribution channels take care of it looking at all.

The pieces has the more complexity it has in terms of building the software. The more opportunity is for just a mistake and not securing something correctly or compromise secret that gives you access to a build manifest or something like that. So it's it's much more effective to think of software supply chain security as vetting the final deliverable, which is the compiled package.

I like to give a given analogy when I give a lot of speaking engagements of an hourglass turn sideways. You have a lot of free compilation activities in terms of development devops ciucd and then post compilation deployment where you're pushing to your cloud or you're containers or your data center. The thing that you're creating is that compiled artifact that exe that dll that war file whatever that is for the application.

That is the thing that is potentially compromised and needs to be investigated in a very very robust way or you may miss things. Interesting. How do you see I mean like your sideways hourglass analogy makes a lot of sense.

Sometimes when you take on a new process or new way of doing things or you're adding to what you're doing introducing change. Yeah. You can also open yourself up to new attacks before absolutely got your hands around.

That's the proper way to do things simplest of example would be I went up to S3 set one up and didn't realize I didn't do it correctly and I can get compromised. Yep. Are there a set of things while you're thinking about software supply chain security to help kind of build the curve and not have any setbacks along the way any recommendations.

Yeah. Absolutely. I mean, I think you know with any, you know application security program or tool having a policy that fits your threat kind of appetite is one of the most important things, you know, it's like hey, let's do software supply chain security.

What does that mean? We always have to start with a plan and that plan is a policy or a set of standards that you're holding yourself accountable to that. If any of these policies or any of these activities happen or identified you fail to build you don't release it.

And I think that is one of the biggest things that people need to do. It doesn't matter if they're using a SAS skin or a gas scanner. those all that tooling looks for risk and they're very good at finding specific types of risks, whether that's in a running application source code apis so on and so forth, but if you don't actually tune or come up with a plan for what you're concerned about you're gonna be in overload of vulnerabilities you're going to get more things more lists that basically overwhelm development staff Architects for remediation and let's work smarter not harder and really start with a plan that is Potentially in line with the things you're trying to protect yourself against cool.

I'd love to hear how you let's say you sit down with a fallacy so in a conversation at RSA and you're talking about what what reversing Labs does. Tell us about because they're you're not speaking marketing speak. You're not speaking from a brochure you're talking kind of practitioner to practitioner.

But how do you describe reversing class? I like to start the conversation with and I you know, I again been in application security a long time and everyone wants to poo-poo other capabilities like us, you know, this is a replacement or better than sass or this is better than SCA or you know, everyone's trying to you know, you know pump themselves up and see how they are. The thing that I like to say is those tools are fantastic at looking at what they were architect for vulnerabilities and source code vulnerabilities are running application vulnerabilities during a functional test identified during a functional test during QA.

But the homework assignment, I want to give everybody is look at all these tooling. We're great. See if you can.

Find malware in their capabilities when talking people talk software supply chain in a you know application security testing or AST tool says hey, we do that as well or an SCA vendor says hey, we do software supply chain malware is the biggest issue associated with software supply chain attacks. None of those Legacy or you know commonplace AST tools really look for malware. It's a different lens of risk and usually that malware analysis was in the sock sock analysts would use his tricks that he has to actually, you know, identify research detonates sandbox malware, but now it's actually something that is I believe more mainstream for the application security profession.

A way to look at what you're saying is we're all going to be already have been breached where have we have those experience? It's not if or when it's it happens and it's going to continue to happen to some degree. You can do things to prevent it but one once a 6X full compromise, your attack is happening.

What do they do? It's for some some purpose that the data injection of malware. So now what do you do once that's happened right?

Well, that's the remediation and having something that you know quickly identifies. What has happened why it's happened and how to actually recover from and that's the thing. Most of these are novels they've never been seen before so you have to you know, it's very hard to find something if you don't know what to look for.

Can you test for you? Can't test for everything? Yeah, and if you don't know that your build was compromised or you're the source code was basically manipulated in some way in shape and form.

I really think that the best programmer the best approach is to think out of the box in terms of your testing. Don't just think that you know, it's magically gonna fix itself. If I find it, you know, you have to be proactive and then you have to have a plan to be reactive because the next you know, log for J or spring shell or software supply chain attack is going to happen.

You should have the the plan in place for remediation cycle, you know all hands on deck who is the one that's actually going to fix this and that's probably it doesn't probably it does depend on what type of attack it is. Is it a tooling attack? Is it a typo squatting?

Is it a potential? Might have a secret. There should be a plan for each of these type of attacks predetermined defined and ready to roll out when you know a new incident is discovered.

Awesome. Well Matt, it's been great talking with you. How's the show been going for you?

I know it's just kind of feels more back towards that I say we love and appreciate. Yeah, my feet hurt and my voice is starting to get a little scratchy and it's Wednesday. Yes this Wednesday one more day.

And I believe that I would like to you know, just take a breath and I think that it's been a fantastic show seeing a lot of old colleagues met a ton of new people and the conversation has been in my opinion. Very good. I've enjoyed it very much.

I want to thank you. And also we're in reversing lab the team there for also sponsoring the devops connect depth psychops day on Monday, that's some great panels and conversations. And yeah thanks to technology companies like yourself.

Hey, welcome to put those things on. So thank you for I feel that's a great event. I've been to what many times and it's just I don't know it's to the point.

It's yeah great speakers a few of the people. I knew pretty well that we're on panels and you know one on Speaking opportunities. I think it's a great event.

And if you know the audience out there is coming to RSA next year. I would highly suggest attending the event we'll do. It's been fantastic manufacturer.

We have a virtual version of that with some additional Speakers and Things coming out. It's in June Kentucky check tech strong events calm. I'll tell you but Matt it's been wonderful talking.

Thank you. Appreciate you having me have a good rest of the show rest the dogs, you know where I'm out before. Yeah, there's gonna happen.

It's good great, Matt Rose just feel she's so with reversing Labs another fantastic guest we will be back. I think we've got one more interview for the day at least one, and we'll plug that in here in just a moment. So thanks for hanging in there with us.

We'll be back from our Sac today 2023