{"id":18851,"date":"2022-04-25T07:10:16","date_gmt":"2022-04-25T15:10:16","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/04\/25\/news-12584\/"},"modified":"2022-04-25T07:10:16","modified_gmt":"2022-04-25T15:10:16","slug":"news-12584","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/04\/25\/news-12584\/","title":{"rendered":"Why our software has so many vulnerabilities, with Tanya Janca: Lock and Code S03E09"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Mon, 25 Apr 2022 14:32:39 +0000<\/strong><\/p>\n

Less than one year ago, the worst ransomware attack in history struck dozens of organizations<\/a>. Threat actors had exploited a serious flaw in the remote monitoring and management tool Kaseya VSA that, when discussed on the Lock and Code podcast, was revealed to be “not advanced at all.”<\/p>\n

This was far from the only software vulnerability that the public learned about last year. <\/p>\n

When Lock and Code discussed the efforts by agricultural companies to turn their physical equipment, like tractors and combines, into smart devices<\/a>, we learned about simple flaws that allowed a group of hackers to uncover user IDs for pretty much every registered device in a company\u2019s database. And we learned that the IDs could, through a simple comparison search with the Fortune 500, reveal what companies were clients of that agricultural company.<\/p>\n

And when we discussed the famous app Clubhouse<\/a>, we learned about an eavesdropping flaw that was discovered with no technical hacking requirements\u2014all that was necessary was two iPhones.<\/p>\n

These examples and many, many more throughout cyber-history beg the question: What is going on with how our applications are developed?<\/p>\n

Today on the Lock and Code podcast with host David Ruiz, we speak to returning guest Tanya Janca to understand the many stages of software development and how security trainers can better work with developers to build safe, secure products. According to Janca, a good security team takes the security of their developers’ products as their own responsibility. <\/p>\n

\n

“It\u2019s our job to help them make their software secure. If at the end, they have all these things wrong, guess what, it\u2019s because our team, the security team, is not doing a good job”<\/p>\n

Tanya Janca, Director of developer relations of Bright, founder of the online training academy We Hack Purple and author of Alice and Bob Learn Application Security.<\/cite><\/p><\/blockquote>\n

Tune in to hear all this and more on this week\u2019s Lock and Code podcast by Malwarebytes Labs.<\/p>\n

\n