Chris Hughes

Securing Agentic AI @ Zenity | Founder @ Resilient Cyber | 3x Author | Veteran | Advisor

[Chris Hughes @ResilientCyber]

@giliraanan @twentyminutevc @HarryStebbings Really enjoyed this episode, especially from someone who’s had so much success in the cyber ecosystem.

[Chris Hughes @ResilientCyber]

@stevespringett Yeah that seems like a broad interpretation that overlooks the reality that there’s no contractual relationship and most FOSS is provided as-is, and they owe the consumers nothing, including an SBOM.

[Chris Hughes @ResilientCyber]

Public Service Announcement (PSA).

Free and Open Source Software (FOSS) contributors/maintainers are not your suppliers.

That is all.

[Chris Hughes @ResilientCyber]

@nnennahacks @tonylturner @psvann Glad you’re enjoying it!

[Chris Hughes @ResilientCyber]

“It’s important to influence designers of future computers and software so that security controls can be installed before the fact and as an integral part of the system”

[Chris Hughes @ResilientCyber]

@lorenc_dan I run my own fiber and mine my own silicon too.

[William Toll @utollwi]

The Elusive Built-in not
Bolted-on
A look at CISA's "Shifting the Balance of
Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default" publication via ⁦@ResilientCyber⁩

[Chris Hughes @ResilientCyber]

@utollwi Thanks for the share!

[Chris Hughes @ResilientCyber]

@allanfriedman Look forward to seeing everyone there!

[Chris Hughes @ResilientCyber]

As an industry we’re best-practices rich and implementation poor.

[Chris Hughes @ResilientCyber]

@lorenc_dan FedRAMP CISO? 😆

[Mark Manning @antitree]

PiPI package "keep" used a malicious version of "requests" as a dependency. It was used to steal passwords. These attacks keep coming.
https://t.co/5s4v5ArAQt

[Chris Hughes @ResilientCyber]

@BogieBalkansky @chainguard_dev Definitely one of the most critical areas of cybersecurity and IT and Chainguard is an industry leader on this front!

[Chris Hughes @ResilientCyber]

@lorenc_dan @allanfriedman 👀

[Chris Hughes @ResilientCyber]

Excellent article discussing the value and shortfalls of SBOM’s for software supply chain security and how coupling SBOM with SLSA helps fill some gaps.

It touches on:

- Responding to build tampering attacks such as Solarwinds an…https://t.co/pN8U5LxUDk https://t.co/AUsWoWHdww

[Chris Hughes @ResilientCyber]

Awesome article comparing Falco and GuardDuty for Amazon Web Services (AWS) EKS Threat Detection by two of my colleagues Dustin Whited and Dakota Riley

They discuss:

- Kubernetes adoption

- Shared Responsibility Model in the con…https://t.co/JJMzqR0Ood https://t.co/Aa3MlFyKIv

[Chris Hughes @ResilientCyber]

About a month ago I had the chance to join NDIA New England to speak on a panel titled "Zero Trusts Given" with Dave Lago, Patrick Perry and moderator Ryan Heidorn

The recording for our talk, which starts at the 1 hour 45 minute mark, along with the rest…https://t.co/E7sFHcPLjo

[Chris Hughes @ResilientCyber]

Yes, another Software Supply Chain Security post today, no I'm not sorry.

--

"The Office of Management and Budget is preparing to release new requirements around software supply chain and cybersecurity, according to a top federal…https://t.co/BUIMFSgPqb https://t.co/Pj83YH8cbq

[Chris Hughes @ResilientCyber]

I'm a big fan of excellent writing and articles and War on the Rocks puts out some great ones.

That's why I was excited to see them publish an article on the Open Source Software (OSS) and Software Supply Chain challenges, and it…https://t.co/lckwPZvMeW https://t.co/qpljPlYcie

[Chris Hughes @ResilientCyber]

National Institute of Standards and Technology (NIST) has just released the final version of 800-161 r1 "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations".

This guidance comes at a critical time, as the software supply c…https://t.co/4tjzKs3wZV