Call us now:
The SDLC is complex and open source code is used to save time an money on code development. The challenge is knowing what is in opensource code, maintaining updates and patches and you have no idea what is being collected and where data is being sent.
In this case it appears that a firm that was thought to be U.S based is based in Russia, and creates code that is used by high profile names, including Apps that were used by the DoD. That at this time of geopolitical tension is difficult to justify.
Fortunately the White House issued a memo in September 2022 requiring Federal agencies and their software developers to identify the source of code that they use or have created under FISMA (https://lnkd.in/eH9jwHZH) and apply a secure SDLC process across its software procurement supply chain.
Saying that I don’t see self attestation working in this case.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #securesdlc
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6997981131715325952