Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Secure Software Ecosystem

Ali Yazdani
May 28, 2024
Technology
0
37

Secure Softwareย Ecosystem

Are We Ready for the Next Cybersecurity Crisis Like Log4J? Probably not.

In a world where vulnerabilities like Log4J, Spring4Shell, and the XZ Backdoor make headlines, securing our software has never been more critical.

I am excited to co-present "Secure Software Ecosystem" at TEQnation 2024 with Soroosh Khodami. We will share our combined expertise in software development and security from two different points of view. Our session aims to provide you with essential insights and practical strategies to enhance your security posture.

๐Ÿ“œ Key takeaways you don't want to miss:
๐Ÿ”ธ The role of DevSecOps in application security.
๐Ÿ”ธ Best practices for creating a robust and secure software ecosystem.
๐Ÿ”ธ Understanding Supply Chain Attacks and their significance.
๐Ÿ”ธ The importance of the Software Bill of Materials (SBOM) and the best solutions available.
๐Ÿ”ธ Techniques for securing cloud-native applications from development through deployment.
๐Ÿ”ธ An overview of EU regulations on supply chain security and their impact on the software development ecosystem.

Ali Yazdani

May 28, 2024
Tweet

Other Decks in Technology

See All in Technology
Amazon Kendra GenAI Index ็™ปๅ ดใงใฉใ†ๅค‰ใ‚ใ‚‹๏ผŸ ่ฉ•ไพกใ‹ใ‚‰ๅญฆใถๆœ€้ฉใชRAGๆง‹ๆˆ
naoki_0531
0
100
Snowflakeๅฅณๅญไผš#3 Snowpipeใฎ่‰ฏใ•ใ‚’5ๅˆ†ใง่ชžใ‚‹ใ‚ˆ
lana2548
0
220
็ต„็น”ใซ่‡ชๅ‹•ใƒ†ใ‚นใƒˆใ‚’ๆ›ธใๆ–‡ๅŒ–ใ‚’ๆ นไป˜ใ‹ใ›ใ‚‹ๆˆฆ็•ฅ๏ผˆ2024ๅ†ฌ็‰ˆ๏ผ‰ / Building Automated Test Culture 2024 Winter Edition
twada
PRO
11
3.3k
ใฉใกใ‚‰ใ‚’ไฝฟใ†?GitHub or Azure DevOps Ver. 24H2
kkamegawa
0
620
ใ‚ตใ‚คใƒใƒผๆ”ปๆ’ƒใ‚’ๆƒณๅฎšใ—ใŸใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใ‚ฌใ‚คใƒ‰ใƒฉใ‚คใƒณ ็ญ–ๅฎšใจASMๅŠใณCNAPPใฎๆดป็”จๆ–นๆณ•
syoshie
3
1.2k
ๆ–ฐๆฉŸ่ƒฝVPCใƒชใ‚ฝใƒผใ‚นใ‚จใƒณใƒ‰ใƒใ‚คใƒณใƒˆๆฉŸ่ƒฝๆคœ่จผใ‹ใ‚‰ๅพ—ใ‚‰ใ‚ŒใŸ่€ƒๅฏŸ
duelist2020jp
0
210
.NET 9 ใฎใƒ‘ใƒ•ใ‚ฉใƒผใƒžใƒณใ‚นๆ”นๅ–„
nenonaninu
0
440
ใ‚ขใƒƒใƒ—ใƒ‡ใƒผใƒˆ็ดนไป‹๏ผšAWS Data Transfer Terminal
stknohg
PRO
0
170
QiitaๅŸ‹ใ‚่พผใฟ็”จใ‚นใƒฉใ‚คใƒ‰
naoki_0531
0
350
็”ŸๆˆAIใฎใ‚ฌใƒใƒŠใƒณใ‚นใฎๅ…จไฝ“ๅƒใจ็พๅฎŸ่งฃ
fnifni
1
180
kargoใฎ้ญ…ๅŠ›ใซใคใ„ใฆไผใˆใ‚‹
magisystem0408
0
200
ใ‚ตใƒผใƒ“ใ‚นใงLLMใ‚’ๆŽก็”จใ—ใŸใฐใฃใ‹ใ‚ŠใซๆŒฏใ‚Šๅ›žใ•ใ‚Œ็ถšใ‘ใŸใ“ใฎไธ€ๅนดใฎใ‚ใ‚Œใ‚„ใ“ใ‚Œใ‚„
segavvy
2
360

Featured

See All Featured
Evolution of real-timeย โ€“ Irina Nazarova, EuRuKo, 2024
irinanazarova
5
440
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
132
33k
Done Done
chrislema
181
16k
Making Projects Easy
brettharned
116
5.9k
Intergalactic Javascript Robots from Outer Space
tanoku
270
27k
Product Roadmaps are Hard
iamctodd
PRO
49
11k
Embracing the Ebb and Flow
colly
84
4.5k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
32
2.7k
Keith and Marios Guide to Fast Websites
keithpitt
410
22k
Statistics for Hackers
jakevdp
796
220k
ใƒ”ใƒณใƒใ‚’ใƒใƒฃใƒณใ‚นใซ๏ผšๆœชๆฅใ‚’ใคใใ‚‹ใƒ—ใƒญใƒ€ใ‚ฏใƒˆใƒญใƒผใƒ‰ใƒžใƒƒใƒ— #pmconf2020
aki_iinuma
111
49k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
159
15k

Transcript

  1. Secure Software Ecosystem 22 May - Soroosh Khodami & Ali

    Yazdani

  2. NOT VERY LONG AGO

  3. โ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—โ–‘โ–‘โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–‘โ–‘โ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•—โ–‘โ–ˆโ–ˆโ•”โ•โ–‘โ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ•šโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–‘โ•šโ•โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ•šโ•โ•โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ•šโ•โ•โ•โ•โ•โ•โ•โ–‘โ•šโ•โ•โ•โ•โ•โ–‘โ–‘โ•šโ•โ•โ•โ•โ•โ•โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ•šโ•โ•โ•šโ•โ•โ•โ•โ•โ•โ–‘โ•šโ•โ•โ–‘โ–‘โ•šโ•โ•โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•โ•โ•โ•โ•โ• CVE-2021-44228 CVSS Score 10

    / 10 CVE-2024-3094 CVSS Score 10 / 10 CVE-2022-22965 CVSS Score 9.8 / 10 CVE-2020-10148 CVSS Score 9.8 / 10

  4. We are living in unsecure world everything is probable to

    get exploited. We could be the next target, are we ready ?

  5. of all downloads of Log4J are still vulnerable to the

    Log4Shell Vulnerability 30% Reported By Sonatype (Maven Central) Previous Update: https://www.sonatype.com/en/press-releases/critical-log4j-vulnerability-still-being-downloaded-40-of-the-time 2 Years After Release

  6. WHY WE ARE HERE SECURITY ENGINEER D E V I

    L D E V E L O P E R

  7. WHO WE ARE SECURITY ENGINEER D E V E L

    O P E R Ali Yazdani Soroosh Khodami +10 Years of Software Development Experience Researcher in Software Supply Chain Security Solution Architect at Rabobank via Code Nomads +10 Years of Security Experience Principal Security Engineer @ Scoutbee OWASP DevSecOps Guideline Project Lead @SorooshKh linkedin.com/in/sorooshkhodami ASecurityEngineer.com @asecengineer linkedin.com/in/aliyazdani

  8. CLASSIC CYBER ATTACKS SQL Injection Cross-Site Scripting (XSS) Cross-Site Request

    Forgery (CSRF) DDoS Man-in-the-Middle Remote Command Execution Malware Injection Buffer Overflow Privilege Escalation Zero-Day Exploits Server-Side Forgery (SSRF) Read More ยง https://portswigger.net/web-security/learning-paths ยง https://www.certifiedsecure.com Phishing

  9. Security Risk Tranformation Read More https://owasp.org/www-project-top-ten/

  10. Supply chain attack Dependency Confusion Software Supply Chain Hijacking Counterfeit

    Components Third-Party Compromise Compromised Build Environments

  11. Dependency Confusion mycompany-ui-component version : 6.6.6 mycompany-ui-component version : 1.2.5

    Private Repository Source Code ? Read More โ€ข How it started - https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

  12. HOW TO DOWNLOAD WHOLE INTERNET WITH ONE COMMAND ?

  13. $ npm install

  14. Letโ€™s create a HELLO WORLD APP

  15. HELLO WORLD Dependency GRAPH Depth = 0 -> 1 Dependency

    Depth = 1 -> 32 Dependencies Depth = 2 -> 65 Dependencies

  16. Supply Chain Protection Best Practices Reserve Namespace / Scope /

    Prefix Version Pinning No Latest or Range Package Integrity Check Using SCA Tools Using Dependency Firewall Official Repositories MUST GOOD NICE Read More โ€ข How it started - https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 โ€ข https://xygeni.io/blog/lack-of-version-pinning-and-dependency-confusion/ โ€ข https://github.blog/2021-02-12-avoiding-npm-substitution-attacks/ โ€ข https://books.sonatype.com/mvnref-book/reference/running-sect-options.html#running-sect-deps-option Keep Dependencies Up to Date Clean Up Unused Libraries Immutable Versions

  17. When Security is Involved in Software Development? Application Development Journey

    Already Changed!

  18. Traditional Approach Design Develop Deploy Staging Production Lucky security tester

    Unlucky security tester

  19. Detect Early, Pay Less! Refrence https://www.nowsecure.com/blog/2017/05/10/level-up-mobile-app-security-metrics-to-measure-success/ https://www.packtpub.com/product/practical-cybersecurity-architecture/9781838989927

  20. Modern Approach Design Develop Deploy Staging Production ยง DAST ยง

    Load/Stress Test ยง 4-Eyes Principle ยง Secret Scanning ยง SAST/SCA ยง IaC Scanning ยง Container Image Scanning ยง Security Design ยง Threat Modelling S H I F T L E F T Phases can cover but can't replace each other. โ€ข Continuous Dependency Monitoring โ€ข Firewall โ€ข Runtime Application Security โ€ข Pentest / Bug Bounty โ€ข Vulnerability Disclosure Program โ€ข Logging & Monitoring โ€ข Cloud Native Application Protection Read more โ€ข OWASP DevSecOps Guideline - https://github.com/OWASP/DevSecOpsGuideline

  21. Still ... lop Deploy Staging Production ยง DAST ยง Container

    Image Scanning ยง Load/Stress Test t Scanning SCA canning โ€ข Continuous Dependency Monitoring โ€ข Firewall โ€ข Runtime Application Security โ€ข Pentest / Bug Bounty โ€ข Vulnerability Disclosure Program โ€ข Logging & Monitoring โ€ข Cloud Native Application Protection https://www.youtube.com/watch?v=gdsUKphmB3Y Read more โ€ข OWASP DevSecOps Guideline - https://github.com/OWASP/DevSecOpsGuideline

  22. Continuous Dependency Monitoring In Production

  23. Continuous Dependency Monitoring Generating list of Dependencies (SBOM) Continuous Monitoring

    After Deploying to Production

  24. Software Bill of Material (SBOM) Dependencies Components / Libraries Licenses

    Vulnerabilities Suppliers App Meta-Data App Identifier Authors

  25. Which Application ? Who to contact ? How to Fix

    ? How to detect ? โ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—โ–‘โ–‘โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•—โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–‘โ–‘โ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•—โ–‘โ–ˆโ–ˆโ•”โ•โ–‘โ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ•šโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–‘โ•šโ•โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–‘โ–‘โ–‘ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ•šโ•โ•โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘โ–‘โ–‘โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ•šโ•โ•โ•โ•โ•โ•โ•โ–‘โ•šโ•โ•โ•โ•โ•โ–‘โ–‘โ•šโ•โ•โ•โ•โ•โ•โ–‘โ–‘โ–‘โ–‘โ–‘โ–‘โ•šโ•โ•โ•šโ•โ•โ•โ•โ•โ•โ–‘โ•šโ•โ•โ–‘โ–‘โ•šโ•โ•โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•โ•โ•โ•โ•โ• CVE-2021-44228 CVSS Score 10 / 10 h Application ? Who to contact ? How to Fix ? How to detect ? cation ? Who to contact ? How to Fix ? How to detect ? Which Application ? Who to contact ? How to Fix ? How to d Which Application ? Who to contact ? How x ? How to detect ?

  26. SBOM Management SBOM In Practice SBOM App SBOM App SBOM

    App SBOM App Continuous Monitoring ZERO DAY ALERT ! Search Apps Based On Dependency or CVE Which Applications ? Authors/Committers Information is Available Who to Contact ? Continuous Monitoring on New SBOMs Are we safe now ? (Realtime-overview) Application Metadata Prioritization on Fix

  27. How to Generate SBOM

  28. SBOM Generation Artifact Container Image Source Code Runtime Env

  29. SBOM Journey In CI/CD Generate Software Bill of Material

  30. SBOM Generation - Generic Read more โ€ข OWASP DevSecOps Guideline

    https://github.com/OWASP/DevSecOpsGuideline

  31. SBOM Generation โ€“ Java Ecosystem Version +3.3 Read more โ€ข

    OWASP DevSecOps Guideline https://github.com/OWASP/DevSecOpsGuideline โ€ข Securing the Supply Chain for Your Java Applications by THOMAS VITALE - https://www.youtube.com/watch?v=VM7lJ0f_xhQ

  32. SBOM Generation - Docker Read more โ€ข OWASP DevSecOps Guideline

    - https://github.com/OWASP/DevSecOpsGuideline โ€ข Securing the Supply Chain for Your Java Applications by THOMAS VITALE - https://www.youtube.com/watch?v=VM7lJ0f_xhQ โ€ข https://earthly.dev/blog/docker-sbom/

  33. Software Composition Analysis (SCA)

  34. SBOM Journey In CI/CD Software Composition Analysis (SCA)

  35. Software Composition Analysis (SCA)

  36. Software Composition Analysis (SCA) Commercial Free/Open-Source Read more โ€ข OWASP

    DevSecOps Guideline - https://github.com/OWASP/DevSecOpsGuideline

  37. SBOM Journey In CI/CD SBOM Management & Continious Monitoring

  38. SBOM Management

  39. SBOM Management Commercial Tools Free / Open-Source OWASP Dependency Track

    Read more โ€ข OWASP DevSecOps Guideline https://github.com/OWASP/DevSecOpsGuideline

  40. Am I Prepared Now? Firewall Continuous Monitoring Logging & Monitoring

  41. None

  42. Dev Sec Ops

  43. The team story

  44. The team story DevSecOps destroy silos to achieve the goal

    of delivering secure and stable software quickly.

  45. Regulations Insights

  46. Regulations Read more โ€ข NITA - https://www.ntia.gov/page/software-bill-materials โ€ข NIST -

    https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-software-1+ โ€ข EU Cyber Resilience Act (CRA) ยง Executive Order 14028 on Improving the Nationโ€™s Cybersecurity ยง DHS Software Supply Chain Risk Management Act ยง FDA Medical Device Cybersecurity Requirements ยง NIST SP 800-218 โ€ข DORA โ€“ EU Cyber Resilience Operation (Financial Sector) โ€ข GERMANY โ€“ TR - 03183: SBOM Requirements for CRA

  47. Regulations โ€“CRA Timeline NOW Enter Into Force 2024 โ€“ Q2

    Deadline 2026 Q1 Read more โ€ข https://medium.com/@bugprove/eu-cyber-resilience-act-cra-all-you-need-to-know-in-a-nutshell-b843d149e18a

  48. Regulations โ€“ DORA Timeline NOW Enter Into Force Deadline 2025

    - Q1 Read more โ€ข https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en โ€ข https://www.eiopa.europa.eu/document/download/2888a8e8-4a20-4e27-ad51-7ad4e5b511f7_en

  49. Standards ISO/IEC 27036 Cybersecurity โ€” Supplier relationships Frameworks Supply-chain Levels

    for Software Artifacts Read more โ€ข https://www.iso.org/standard/82905.html โ€ข https://cyclonedx.org โ€ข https://spdx.dev/ โ€ข https://slsa.dev/ SBOM Format Standard Software package data exchange (SPDX) SBOM Format Standard CycloneDX (CDX)

  50. Thanks for your attention If you have any other questions,

    you can reach out to us via Social Media @SorooshKh linkedin.com/in/sorooshkhodami @asecengineer linkedin.com/in/aliyazdani
  51. None