CISOs & Senior Cybersecurity Leaders - Protecting Developers

The world's largest heist, the hack of cryptocurrency exchange Binance, started when a developer there downloaded malware whilst trying to install "a popular AI coding tool." (They were later tricked into taking a fake job interview and doing a coding "test" that led them to download more malware.) The recent compromise of an important code repository belonging to European cloud provider OVHcloud also started because a developer unwittingly downloaded a malicious software extension onto their personal MacBook, so they could use funky colours on their laptop. (Visual Studio Code extension Colour Picker Universal version 2.8.91, since you asked.) Developers are also being targeted further “upstream”; overwhelmed open-source project operators have been groomed into accepting help on their projects; help that turns out to be malicious and designed to compromise software supply chains at staggering scale. (xz-utils still reverberates.) I’d like to write a deep-dive for The Stack into how security functions are thinking about how they protect their developers; across everything from security awareness and training, via #BYOC policy guardrails, #EDR, and beyond. I’m particularly interested in hearing from #CISOs and other senior #cybersecurity figures about this. If you’d like to share your views (or #PR friends, you think you have a client spokesperson who might be strong and experience on this; please no generic AI fluff) do pop me an email with “protecting developers” in the subject line. #infosec #journorequest #techpr