EdgeBit

Real-time supply chain security that connects builds/SBOMs to the kernel, enabling security teams to target & coordinate vulnerability remediation without toil.

[EdgeBit @EdgebitIO]

EdgeBit is leaning hard into a “find, fix and merge” ethos by introducing Dependency Autofix to our security platform.

Dependency Autofix makes your code branches have the latest & safest set of dependencies, using AI and static analysis under the hood.

https://t.co/fFdaEY5aoJ

[EdgeBit @EdgebitIO]

EdgeBit now supports syncing workloads from ECS in addition to existing EKS, Kubernetes, EC2 and other Linux workloads. Runtime context is the only way to understand your risk *right now* and powers a highly automated security program.

More: https://t.co/RhrYmyzfw4

[EdgeBit @EdgebitIO]

We’ve partnered with Vanta to give EdgeBit customers greater context and increased automation around vulnerability management in their compliance programs.

More on the blog or log in to Vanta or EdgeBit to get started.

https://t.co/Pq21yQTO5c

[EdgeBit @EdgebitIO]

We're looking for a Graduate-level Software Engineering Intern to join the team this summer to focus on code analysis. Ideal candidates have a focus or concentration in programming language theory or compiler construction. See our careers page for more: https://t.co/j58QhIOvbk

[EdgeBit @EdgebitIO]

Can Linux enforce that a workload's SBOM remains a truthful representation of the running app? EdgeBit authored a paper covering the research to find out.

This will be published in an ACM journal but you can find more detail & background on our blog today https://t.co/6931BWv6RL

[EdgeBit @EdgebitIO]

EdgeBit is speaking all over at the end of November:

- Nov 16th @ Bay Area SLSA meetup: https://t.co/7cPxayq4ZV
- Nov 17th @ RVA.js conf: https://t.co/kVsypWf27a
- Nov 30th @ ACM Workshop on Software Supply Chain Offensive Research & Ecosystem Defenses: https://t.co/BNG1mKfVWM

[EdgeBit @EdgebitIO]

A "critical" vuln score is actually a CVSS score. v4 just came out, and we break it down here: https://t.co/Juq0NHS46C

Super excited about bringing more environmental context to scoring. CVSS has its issues, but this is a step in the correct direction.

[EdgeBit @EdgebitIO]

Software inventory is still hard. Last week's curl and Rapid Reset vulns were a scramble – unless you have an up-to-date inventory and bill of materials for your apps

[EdgeBit @EdgebitIO]

Join us next week as we chat Supply Chain Security with @redhat in Raleigh
https://t.co/0Tlbg9r9bb

[OpenShift Commons @openshiftcommon]

✨ Join us at @RedHat @OpenShift Commons Gathering in Raleigh, NC in-person on Wednesday, October 18th at Historic Market Hall! We have a full day of case studies, emerging technologies, and open source updates and what's happening in #AI.✨ https://t.co/uVrGF05xqE #raleigh #tech

[EdgeBit @EdgebitIO]

A security scanner detects 73 vulnerabilities.

If all CVEs correspond to dormant code…how many issues do you have? 0 or 73?

We used EdgeBit's tracking of base OS vulnerabilities to reverse engineer the patching practices of EKS & GKE to find out.

https://t.co/xyo0CeXBF9

[EdgeBit @EdgebitIO]

Our CEO @robszumski joined the All Aboard pod to chat about SBOMs, vulnerability management and the latest on government supply chain regulations.

Do you think NIST rolled out supply chain standards correctly? Listen in for Rob's take: https://t.co/LILgecY622

[EdgeBit @EdgebitIO]

Solving AI dependency sprawl: layers of transitive dependencies make it challenging to understand your risk. EdgeBit prioritization based on real time risk cuts through the noise. Read how: https://t.co/sAh21H8M64

[Cloud Native Podcast @cloudnativefm]

OpenVEX is complementary to SBOMs, allowing suppliers to communicate precise metadata about the vulnerability status of products directly to consumers and end users.

More on this debate with @robszumski of @EdgebitIO
@puerco of @chainguard_dev
https://t.co/coUjtPdGrE

[EdgeBit @EdgebitIO]

Introducing EdgeBit Components: a stream of SBOMs enriched with data & tied to running workloads.

Instantly ingested from CI/CD
Enriched with vuln findings, SLAs & auto resolution
Mapped to active workloads
Prioritization based on whats running *now*

https://t.co/eyVG7gJp0c

[EdgeBit @EdgebitIO]

Just out: National Cybersecurity Strategy Implementation Plan with an entire pillar for SBOM maturity and implementation.
Read more: https://t.co/lkfCZVUPn7

[EdgeBit @EdgebitIO]

New FDA cybersecurity regs are catching folks by surprise. Enforcement starts in October 2023.
Learn more about the requirements to submit software bills of materials for Software as a Medical Device (SaMD): https://t.co/dNcVS2i6lF

[EdgeBit @EdgebitIO]

Breaking down successful vulnerability management programs: examples from Lyft, Elastic & research from Sysdig and Kenna. What's in common? CONTEXT! It's essential for your engineers.

https://t.co/3Z1ILBXEcW

[EdgeBit @EdgebitIO]

Vulnerability management gone wrong...with huge impact on voting systems in GA.

Prioritize what you patch and make time to do it! https://t.co/8aEnfRQrUV

[J. Alex Halderman @jhalderm]

Despite our responsible disclosure efforts, the flaws remain unpatched in GA. Among the most critical issues is an arbitrary-code-execution vulnerability that can spread malware from a county's central election management system to all BMDs in the jurisdiction—and run it as root.

[EdgeBit @EdgebitIO]

More info on regulations from the FDA, NIST guidelines and PCI DSS v4: https://t.co/XdpRpZCBlE

[EdgeBit @EdgebitIO]

Security Week on OMB M-22-18: "such guarantees should be provided as a self-attestation form, but agencies may also require a software bill of materials (SBOM) and other artifacts, or may require the vendor to run a vulnerability disclosure program."

https://t.co/fbYc6fIhES

[Eduard Kovacs @EduardKovacs]

OMB has published new guidance on federal agencies obtaining security guarantees from software vendors. https://t.co/nFVlgqC5AD