Happy Thanksgiving, all! To help you ensure your celebration goes without a hitch, here's a threat model that Gunnar Peterson originally developed and Sounil Yu fixed up.

An unknown threat actor published 27 malicious packages on the Python Package Index (PyPI), mimicking popular Python libraries downloaded thousands of times. These packages, including pyefflorer and pywool, were designed to steal sensitive data and access cryptocurrency wallets using steganography to hide malware within image files​. Why is this still a problem? Why can’t we find a solution that solves this issue? For all the software supply chain startups I see floating around, I would think somebody would try to solve this problem with package signing and a trusted repository that could provide a lookup based on package name.

Google discusses improvements to the Minimum Viable Secure Product (MVSP) controls, highlighting how its adoption has enhanced security processes. Despite nearly half of third parties failing to meet multiple MVSP controls, Google's implementation has resulted in faster procurement processes and better data-driven decision-making, reinforcing its importance in product security across the industry​​​​​​​.

The Known Exploited Vulnerabilities (KEV) catalog, a crucial resource for information on software flaws, often experiences delays in updates. Instances like a vulnerability in Adobe's Acrobat and Reader applications demonstrate that while the KEV list is valuable, companies must rely on other threat intelligence sources due to these delays​​​.

The article discusses the growing importance of zero-trust architecture in application security (AppSec). It highlights how traditional trust boundaries are becoming obsolete, necessitating a new approach to threat modeling. The adoption of zero trust in AppSec is critical, but it introduces new challenges, such as the need for a deeper understanding of protected systems and the complexity of implementing granular access controls and continuous monitoring​​​​​​​​​​​​​​​​​​​​​