Today, reporters Betsy Woodruff Swan and Eric Geller at Politico published a story: “BlackBerry resisted announcing major flaw in software powering cars, hospital equipment.” They outline how BlackBerry willfully hid the fact that their key operating system QNX contained a collection of vulnerabilities (originally discovered and named BadAlloc by Microsoft). It seems other companies affected by BadAlloc announced the issue way back in May. Not so...
Recently, we have been fielding many inquiries here at aDolus regarding “VEX.” If you are not familiar with this mysterious abbreviation, you’ve fortunately landed in the right place. This blog post explains what VEX is and the crucial role VEX plays within the Software Bill of Material (SBOM) space.
In today’s blog post I’d like to recognize all the hard work done by NTIA (National Telecommunications and Information Administration) and congratulate them on publishing the minimum elements for a Software Bill of Materials… more commonly referred to as an SBOM. In particular, I’d like to give a shout-out to Allan Friedman who has been championing the SBOM cause for some time now. It’s good to see his committed effort captured in this...
Last week I participated in a panel discussion on the Executive Order’s Impact On Embedded Device Security hosted by ISSSource.com. I signed off with a comment about my biggest worry: someone will combine professional ransomware with a software supply chain attack to create a truly massive ransomware attack.
Cybersecurity veteran tapped to accelerate growth of ICS supply chain security leader
VICTORIA, BC, CANADA, June 23 -- aDolus Technology Inc., a global authority on software intelligence for critical infrastructure, today announced the appointment of Mark Weatherford to its Board of Directors.
Seasoned financial and advisory executive to drive growth
VICTORIA, BC, CANADA, June 15, 2021 /EINPresswire.com/ -- aDolus Technology Inc., a global authority on software intelligence for critical infrastructure, today announced the addition of Rod Campbell as CEO.
Section 3 - Less Fog, More Cloud
Section 3: Modernizing Federal Government Cybersecurity of the Executive Order is all about government agencies moving to the cloud and doing it right. If you are someone who believes that the cloud has absolutely no place in the industrial control systems (ICS) world, you are going to hate this section.
So you don’t sell to the Feds…
Today’s blog is going to take a break from analyzing a specific section of the Executive Order on Improving the Nation’s Cybersecurity and focus on who will be impacted by the order.
I got thinking about this last week when Tom Clary posted this insightful comment on LinkedIn:
[This] Executive Order in no way compels private sector critical infrastructure to do anything different. It seems intended to better protect...
Removing Barriers to Sharing Threat Information
On Friday we dissected Section 4: Enhancing Software Supply Chain Security of the new Executive Order on Improving the Nation’s Cybersecurity. Today we will look at Section 2: Removing Barriers to Sharing Threat Information. We’ve also updated the EO14028 Timeline I posted previously to include Section 2 deadlines:
Late Wednesday night President Biden signed the Executive Order on Improving the Nation’s Cybersecurity.
Compared to any Executive Order (EO) I’ve seen, this is a massive and complex policy document: the average length of an EO has been under 3½ pages; most are just 1 or 2 pages. This EO weighs in at 18 pages with 74 actionable directives. Forty-five of those directives have defined due dates, many linked to the completion of other directives....