{"id":11573,"date":"2022-02-09T22:52:10","date_gmt":"2022-02-09T22:52:10","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/09\/red-hat-will-explore-how-to-manage-risk-in-the-digital-supply-chain-during-feb-15-event\/"},"modified":"2022-02-09T22:52:10","modified_gmt":"2022-02-09T22:52:10","slug":"red-hat-will-explore-how-to-manage-risk-in-the-digital-supply-chain-during-feb-15-event","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/09\/red-hat-will-explore-how-to-manage-risk-in-the-digital-supply-chain-during-feb-15-event\/","title":{"rendered":"Red Hat will explore how to manage risk in the digital supply chain during Feb. 15 event"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

When one major breach technique becomes successful, it\u2019s a sure bet that rapid adoption by threat actors will follow.<\/span><\/p>\n

This maxim has become more evident following a successful attack on the software supply chain through a\u00a0<\/span>breach of SolarWinds Inc.<\/span><\/a> more than one year ago. Software supply chain attacks\u00a0<\/span>grew 650%<\/span><\/a> in 2021, according to a<\/span> report<\/span><\/a> by security provider Sonatype Inc. This was further underscored by the vulnerability\u00a0<\/span>recently disclosed<\/span><\/a> in Log4j, a popular Java logging tool.<\/span><\/p>\n

Red Hat Inc. and theCUBE, SiliconANGLE Media\u2019s livestreaming studio, will tackle these topics and more during the\u00a0<\/span>\u201cHow to Manage Digital Risk by Securing Your Software Supply Chain\u201d<\/span><\/a> event, airing Feb. 15.<\/span><\/p>\n

\u2018Securing Your Software Supply Chain\u2019 event takes aim at reducing digital risk<\/h3>\n

Vulnerabilities in the open-source supply chain make these issues especially troubling based on the widespread use of software tools. The Sonatype data showed that JavaScript developers downloaded\u00a0<\/span>1.5 trillion open-source packages<\/span><\/a> in 2021. At this scale, the presence of malicious code in just a small percentage of these tools could spread far and wide.<\/span><\/p>\n

\u201cThe power of the supply chain, as an amplifying factor, is starting to get exploited really well by the attackers,\u201d said\u00a0<\/span>Ben Fischer<\/span><\/a>, emerging security technology advocate at Red Hat Inc., during an interview with theCUBE, SiliconANGLE Media\u2019s livestreaming studio. \u201cIt\u2019s literally exploding in terms of the threats happening in the supply chain attacks. You should be thinking about where software is being downloaded from; there\u2019s lots of sites and lots of ways to get it.\u201d<\/span><\/p>\n

How organizations can avoid and minimize breaches in an enterprise IT environment under attack will be the focus of the\u00a0<\/span>\u201cHow to Manage Digital Risk by Securing Your Software Supply Chain\u201d<\/span><\/a> event on Feb. 15. The event will feature interviews with experts who will discuss where the greatest threats exist, how to think about open source versus commercial software, and ways that organizations can reduce risks going forward. <\/span>(* Disclosure below.)<\/span><\/i><\/p>\n

Transparency and trust<\/h3>\n

As described in a\u00a0<\/span>blog post<\/span><\/a> by\u00a0<\/span>Chris Wright<\/span><\/a>, Red Hat\u2019s senior vice president and chief technology officer, the company\u2019s philosophy around supply chain security is grounded in an \u201copen approach.\u201d Transparency, partnership and trust are the principles behind what it will take to secure the software supply chain.<\/span><\/p>\n

Using\u00a0<\/span>OpenShift Container Platform<\/span><\/a> as the foundation, Red Hat brings together\u00a0<\/span>trusted third-party tools<\/span><\/a> and prescriptive workflows for best practices, including test-driven development and continuous integration\/continuous deployment.<\/span><\/p>\n

The objective is to create a virtual \u201cwarehouse club\u201d where users can shop for the software tool they need without worrying about where it came from or what it might contain, according to Fischer. It is part of the open-source ethos to foster transparency and openness within the community of enterprise developers.<\/span><\/p>\n

\u201cIn that transparency and collaboration there is a review of all of the code that gets submitted,\u201d Fischer said. \u201cYou could download any bit of open-source software that Red Hat sells, and you can run it today. Red Hat plays a role in that we curate that software. We\u2019re trying to pick the best piece of software that we feel we can trust.\u201d<\/span><\/p>\n

Fostering accountability<\/h3>\n

In addition to Red Hat\u2019s work to foster trust in the software supply chain, there is a\u00a0<\/span>push within the tech community<\/span><\/a> for a\u00a0<\/span>software bill of materials<\/span><\/a>, or SBOM. An\u00a0<\/span>Executive Order<\/span><\/a> issued by the White House in May called for an SBOM as part of a series of recommendations for securing the supply chain.<\/span><\/p>\n

More recently, the Linux Foundation\u00a0<\/span>released<\/span><\/a> a \u201cState of Software Bill of Materials and Cybersecurity Readiness\u201d report, which found that while 78% of organizations surveyed expect to produce or consume SBOMs in 2022, only 47% are actively using them.<\/span><\/p>\n

At a minimum, the Linux Foundation report provided an encouraging signal that awareness surrounding SBOMs and the need for software accountability is growing, making Red Hat\u2019s event on Feb. 15 all the more timely.<\/span><\/p>\n

\u201cJust because you downloaded it from a site, you don\u2019t know who posted it,\u201d Fischer noted. \u201cThe SBOM will give you an understanding of who\u2019s accountable, who actually wrote the software or made the patch or submitted the last update to a branch. At some point, you need to know who did this to verify if something is trustworthy.\u201d<\/span><\/p>\n

Livestream of Red Hat\u2019s \u2018Securing Your Software Supply Chain\u2019 event<\/h3>\n

Red Hat\u2019s <\/span>\u201cHow to Manage Digital Risk by Securing Your Software Supply Chain\u201d event<\/span><\/a> will feature interviews to be broadcast on theCUBE. <\/span>Add this event to your calendar<\/span><\/a> to watch the event live. Plus, you can watch theCUBE interviews <\/span>here<\/span><\/a> on demand after the live event.<\/span><\/p>\n

How to watch theCUBE interviews<\/h3>\n

We offer you various ways to watch Red Hat\u2019s <\/span>\u201cHow to Manage Digital Risk by Securing Your Software Supply Chain\u201d event<\/span><\/a>, including theCUBE\u2019s <\/span>dedicated website<\/span><\/a> and <\/span>YouTube channel<\/span><\/a>. You can also get all the coverage from this year\u2019s events on <\/span>SiliconANGLE<\/span><\/a>.<\/span><\/p>\n

TheCUBE Insights podcast<\/h4>\n

SiliconANGLE also has podcasts available of archived interview sessions, available on <\/span>iTunes<\/span><\/a>, <\/span>Stitcher<\/span><\/a> and <\/span>Spotify<\/span><\/a>, which you can enjoy while on the go.<\/span><\/p>\n

Guests<\/h3>\n

During Red Hat\u2019s <\/span>\u201cHow to Manage Digital Risk by Securing Your Software Supply Chain\u201d event<\/span><\/a>, theCUBE will talk with Red Hat\u2019s Vincent Danen, vice president of product security; Luke Hinds, security engineering lead from the Office of the CTO; and Kirsten Newcomer, director of cloud and DevSecOps strategy.<\/span><\/p>\n

During the livestream, the CUBE will also talk with Red Hat\u2019s Andrea Hall, specialist solution architect and project manager for security and compliance, and Andrew Block, distinguished architect.<\/span><\/p>\n

(* Disclosure: TheCUBE is a paid media partner for the<\/span><\/i>\u201cHow to Manage Digital Risk by Securing Your Software Supply Chain\u201d event<\/span><\/i><\/a>. Neither Red Hat Inc., the sponsor of theCUBE\u2019s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)<\/span><\/i><\/p>\n

Photo: SiliconANGLE<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n