Displaying items by tag: phylum

There is a topic of conversation that really needs to be talked about in the open. It is the danger of developer systems (personal and company owned) being targets of threat groups. It is a fact; it is not going away, and it is something that people need to consider as they plan out their own security programs. I say this on the heels of coming back from Def Con and hearing AI developers tell me they are not worried about abuse of their AI models (LLM or Statistical). The thought process was an attacker would have to go to too much trouble to have any impact on the model, it would not be worth it. While I can understand this line of thinking, I still feel that it is very wrong and short sighted.

Hey, remember that supply chain attack on NPM that happened recently? Which one? Yeah, that is sort of the problem with recent supply chain attacks. In particular the ones that are targeting the development pipeline. This is because they are starting to happen so often that they all blur together, yet NPM and other critical components of the development supply chain are still targets for attackers to either get their malicious packages onto development systems, or in the final compiled binary that is then sent out to the general public. To call this problematic is to describe a nuclear bomb as a big firecracker. Ok, soapbox on the importance of SDLC (Software Development Lifecycle) hygiene and security put away for now.