Veracode Acquires Phylum Tech

January 8, 2025January 8, 2025

Veracode Enhances Software Supply Chain Security with Phylum Acquisition

In a significant move aimed at bolstering software supply chain security, Veracode has announced its acquisition of Phylum’s advanced malicious package analysis and detection technology. This strategic acquisition comes at a time when organizations are facing increasingly sophisticated and costly intrusions in their software supply chains. By integrating Phylum’s innovative technology, Veracode aims to enhance its Software Composition Analysis (SCA) platform, ensuring quicker identification and mitigation of malicious packages found in open-source libraries.

Phylum’s expertise in malicious package detection is expected to provide Veracode customers with greater visibility into open-source security risks. This acquisition is particularly timely as cyber threats continue to evolve, with nearly 500,000 malicious packages identified by Phylum researchers. Although the financial details of the deal remain undisclosed, the integration is set to deliver substantial benefits to Veracode’s clientele.

Benefits of the Acquisition for Software Supply Chain Security

Enhanced Detection Capabilities: The merger of Veracode and Phylum’s technologies is poised to improve the speed and accuracy of malicious package detection.
Improved Visibility: Customers will gain better insight into potential open-source security vulnerabilities, allowing for proactive risk management.
Expertise from Phylum Researchers: The addition of Phylum’s research team will bolster Veracode’s capabilities in combating software supply chain threats.

Phylum co-founder and CEO Aaron Bray emphasized the value of this integration, stating, "Uniting Veracode’s platform and Phylum’s malicious package detection and mitigation technology creates exceptional value for our customers worldwide. By combining our advanced research capabilities with Veracode’s industry-leading platform, we’re expanding the fight against software supply chain threats."

Looking Ahead

Veracode is set to unveil its updated Software Composition Analysis product later this year, which promises to incorporate Phylum’s cutting-edge detection tools. This development is expected to be a game-changer in the realm of software supply chain security, providing organizations with the necessary tools to safeguard their applications against emerging threats.

For further insights on software security trends, consider reading related articles on Cybersecurity Insights and TechCrunch.

Share Your Thoughts

What are your thoughts on Veracode’s acquisition of Phylum? Do you believe this will significantly enhance software supply chain security? Join the conversation by commenting below or explore more articles on software security and cyber risk management.

ConnectOnCall Data Breach Affects Over 910,000 Users

December 18, 2024December 18, 2024

A significant data breach at ConnectOnCall, a telehealth platform owned by Phreesia, has exposed protected health information for over 914,000 patients. The breach, which occurred between February and May, compromised sensitive data, including names, birthdates, medical records, and some Social Security numbers. Phreesia assured clients that other services were unaffected and emphasized the need for improved cybersecurity measures. This incident underscores the critical importance of safeguarding patient information in healthcare through advanced encryption, regular audits, and employee training. The breach serves as a reminder for the industry to prioritize data security to protect patient privacy.

Ransomware 2024: A Year of Gains and Challenges

January 1, 2025January 1, 2025

In 2024, ransomware threats surged, impacting critical sectors like healthcare and infrastructure, with cybercriminals leveraging ransomware-as-a-service (RaaS) to launch attacks. Notable breaches included the Change Healthcare incident, exposing over 100 million patient records and costing $22 million, and an attack on Ascension Health that disrupted hospital operations. The year also saw ransomware weaponized by nation-states, exemplified by North Korea’s Lazarus Group’s $308 million heist. As AI enhanced attack strategies, organizations faced increased recovery costs averaging $3 million. Key lessons include adopting zero-trust architectures, enhancing monitoring, and fostering public-private collaboration to combat evolving threats.

US Bans Data Sales to Rival Nations

December 30, 2024December 30, 2024

The U.S. Department of Justice has finalized a rule to protect Americans’ personal data from adversarial nations, prohibiting the sale of sensitive information such as biometric, geolocation, health, genomic, and financial data to countries like China, Russia, and Iran. This regulation, stemming from a February executive order, aims to enhance national security by preventing the misuse of American data for cyberespionage and the advancement of artificial intelligence. The rule will take effect three months after publication in the Federal Register, allowing organizations time to comply. This initiative reflects ongoing efforts to bolster cybersecurity and safeguard citizens’ rights in the digital age.

Boosting Team Security with Threat-Informed Defense

January 12, 2025January 12, 2025

In today’s cybersecurity landscape, adopting a threat-informed defense strategy is vital for security teams. This approach enhances individual and collective effectiveness by equipping team members with knowledge of cyber adversaries’ tactics, techniques, and procedures (TTPs). Key benefits include heightened awareness of emerging threats, improved decision-making for resource allocation, and enhanced collaboration among team members. Additionally, this strategy fosters continuous skill development, increases efficiency by focusing on relevant threats, and strengthens team dynamics. Ultimately, a threat-informed defense contributes to a more robust organizational security posture, making it essential for all security professionals to embrace.

Microsoft Calls for Urgent Update to .NET Installer Links

January 1, 2025January 1, 2025

Microsoft has announced the upcoming shutdown of Edgio, its Content Delivery Network (CDN), urging .NET developers to transition away from azureedge.net domains by early 2025. Developers should migrate to builds.dotnet.microsoft.com to maintain application functionality and avoid downtime. Key actions include updating dependencies, modifying GitHub Actions, and reconfiguring firewalls. Microsoft has confirmed ownership of the retiring domains but has not provided specific reasons for the shutdown. Staying informed and following the recommended steps is essential for developers relying on the .NET framework to ensure smooth operations. More information is available on the Microsoft .NET blog.

Rubrik Launches New AWS Integrations and API Service

December 12, 2024December 12, 2024

Rubrik has announced significant updates to enhance cloud security, focusing on AWS capabilities and introducing the Rubrik Annapurna API service for generative AI applications. The updated Cloud Vault, previously exclusive to Azure, now offers air-gapped data backup for AWS users, ensuring rapid recovery from cyberattacks and reducing data transfer costs. Additional features include anomaly detection, threat monitoring, and data classification. The Annapurna API service, launching in early 2025, will enable secure integration with platforms like Microsoft Azure OpenAI, supporting compliance and data privacy. These advancements bolster cloud security and optimize data management for businesses.