Proactive Application Hardening with SCA Runtime Protection
On December 15th, 2021, six days after the CVE, Akamai observed Log4j attacks peaking at 25M per hour, yet they also found evidence that zero-day attacks had started months before. Imagine being confident on December 9th that all your applications in production were immune to Log4j’s JndiLookup exploit.
SCA Runtime Protection breaks the kill chain on software supply chain attacks by proactively identifying and blocking all unused Java components & methods (e.g. JndiLookup) to harden against CVEs and future 0day vulnerabilities, massively reducing application attack surface.
By providing real-time “Ops” visibility of your third-party appsec risk in production, whether for in-house developed or COTS-purchased applications, Runtime Protection eliminates the need to rely on developers or vendors for an update or patch to secure your software supply chain.
In this talk, we explain how Runtime Protection works technically and then will show a live demo with an actual application being owned by Metasploit initially via an Apache Struts CVE, followed by the same attack thwarted by Runtime Protection after blocking the vulnerable method from being executed.
About the Presenter: Oscar Van der Meer
Starting his career in the financial industry as an enterprise architect at ING Group in Amsterdam, Mr. Van der Meer distinguished himself as an innovative technology leader. After immigrating to Canada, Oscar joined Central 1, a fintech platform serving credit unions and other financial institutions across Canada, as its VP of Technology. There he grew the engineering and development teams from 35 to over 400 people, earning the position of Chief Technology Officer. This experience helped Oscar to understand firsthand the problems of software supply chain security. It inspired him to found MergeBase and create its full-spectrum DevSecOps solution that engaged the entire technical team from engineering to operations to more effectively manage third-party software risk.
About the Presenter: Shannon James Smith
Shannon describes himself as a "geek-at-heart with a couple of business degrees on the surface." He started writing code on TRS-80s and progressed to running BBSs from his Commodore64 via a 300 baud modem. With 25+ years of executive leadership, business operations, cybersecurity strategy, and technology sales experience, Shannon is a serial entrepreneur and veteran of the VR, Internet, SaaS, big data, computer hardware, SAN storage, enterprise software, e-commerce, information security, and media content security. Shannon earned an undergraduate degree from the Foster School of Business at the University of Washington, and an MBA in Innovation, Strategy & IT from EDHEC Business School in France.
