Call us now:
Cyber attacks are pealing back the underlying code used by software vendors, exposing source code and SDLC risks. Risks that transpose into third party supplier risks for customers and potentially material risks for shareholders.
In the case of Ivanti, it seems to be the product that keeps on giving. The recent issue is not the first time Ivanti code has been exploited, effecting nation state governments. In July 2023 12 Norwegian government agencies were effected by a vulnerability its code (https://lnkd.in/ekG_xs8r).
The recent breach raises questions of U.S Federal agencies that use Ivanti products, and their oversight of software products and services. Back in 2022 the OMB requested that Federal Agencies ensure that software vendors complied with Secure SDLC practices (https://lnkd.in/eH9jwHZH). Amongst other things demonstrating the use of a patch management (in a twist of irony Ivanti offers a patch management product).
One wonders whether Federal Agencies are evaluating compliance to secure SDLC at best. Or if Ivanti did not accurately declare the security of its products, a claim under the False Claims Act. For suppling products that did not comply to appropriate security standards.
If Ivanti were a public company. One wonders if the latest issues would be considered a material risk to itself and also its customers?
Ted Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #sdlc
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7164166126673846272