Detail of shipping container door

Software supply chain security remains a challenge for most enterprises

by with No Comment Tech

Detail of shipping container door

Image Credits: Busà Photography / Getty Images

Log4j, maybe more than any other security issue in recent years, thrust software supply chain security into the limelight, with even the White House weighing in. But even though virtually every technology executive is at least aware of the importance of creating a trustworthy and secure software supply chain, most continue to struggle with how to best implement a strategy around it.

The number of CVEs (Common Vulnerabilities and Exposures) continues to increase at a steady pace and there’s nary a container out there that doesn’t include at least some vulnerabilities. Some of those may be in libraries that aren’t even used when the container is in production, but they are vulnerabilities nevertheless.

Image Credits: Slim.ai

According to Slim.ai‘s latest Container Report, the average organization now deploys well over 50 containers from their vendors every month (and almost 10% deploy more than 250). Yet only 12% of the security leaders who responded to Slim.ai’s survey said they were able to achieve their own vulnerability remediation goals. Everybody else says they are “greatly” struggling or see significant room for improvement. And while those organizations are all pressuring their vendors to improve their security stance and deliver, the vendors and buyers often can’t even agree on which CVE’s actually need patching in a container.

As Ayse Kaya, Slim.ai’s VP for Strategic Insights and Analytics told me, the interaction between buyers and vendors is often still driven by the exchange of spreadsheets and ad hoc meetings between security groups. According to the company’s report, which it created in partnership with research firm Enterprise Strategy Group, that’s still how 75% of organizations exchange information with their vendors, even as virtually all security leaders (84%) would look to see a centralized collaboration platform for managing vulnerabilities. For the time being, though, it seems like emailing spreadsheets back and forth remains to be the state of the art.

Image Credits: Slim.ai

All of this inevitably leads to inefficiencies. The majority of organizations that responded to the survey said they employ six or more specialists who focus on vulnerability remediation (with a quarter of respondents employing more than 10). One of the major problems in the industry is that more than 40% of the alerts these teams get are false positives — often for libraries that may be part of a container but aren’t used in production. Because of this, Kaya for example greatly advocates for creating minimal container images. One could argue that this should be a best practice anyway, since it creates a smaller attack surface and reduces false positives.

It’s not just security teams that have to deal with these vulnerabilities, though, of course. All of these efforts slow down the overall development process, too. Most companies see some disruptions multiple times a week because they detect a vulnerability in a production container, for example. According to Slim.ai’s report, the average container now sees a new release roughly every 11 days and the average container is now affected by 311 CVEs (up from 282 in 2022). All of that means more work, more interruptions and more effort expended in working with vendors to get them fixed.

The downtown Tulsa Skyline from across the Arkansas River at dusk.

Tulsa's tech scene remains resilient amid state's anti-DEI efforts

by with No Comment Tech

The downtown Tulsa Skyline from across the Arkansas River at dusk.

Image Credits: chrisp0 / Getty Images

Oklahoma took a stand against diversity, equity and inclusion (DEI) last month. The state’s governor, Kevin Stitt, signed an executive order defunding DEI efforts in public colleges and universities and banning it in other state agencies.

He said the move would take “politics out of education” and encourage “equal opportunity rather than promising equal outcomes.” Affirmative action itself has been banned in the state since 2012.

This latest executive order does not target student organizations, but it does ban state resources from being used for diversity training and asks for a review of current DEI programs to eliminate any “non-critical personnel.” Oklahoma is following in the footsteps of Florida, Texas, South Dakota, North Carolina and Tennessee in attempting to curb DEI initiatives at public colleges.

But public colleges aren’t the only ones being affected; this is part of a broader backlash to DEI that has become prevalent in many industries, from technology to academia to fashion. Supporters of DEI say these initiatives help everyone get ahead, especially marginalized communities that have been historically disenfranchised. Critics call DEI-related work a form of discrimination.

The hard-line stance Oklahoma has taken against DEI is at odds with the efforts of its Tulsa tech hub. For the past decade, Tulsa has been trying to attract talent from all over the nation. It’s also, most notably, trying to rebuild Black Wall Street, a once-prosperous Black business neighborhood that white supremacists bombed in the 1920s.

Tulsa is trying to build a startup ecosystem from scratch

Tré Baker, managing director at Tulsa Techstars, said that the executive order does not materially change business on the ground. The city’s ecosystem has become accustomed to dealing with constraints since affirmative action was banned in the state back in 2012. The government also has no control over private investment decisions. He said it’s as simple as not publicly announcing any preference for one group over another.

“The problem is not the law, the problem has always been people making investment decisions,” he said. “When we empower more Black investors, more Black founders will get funded.”

Still, others are afraid this could dampen the appeal of Tulsa that attracted people to the city in the first place. Nicholas Lalla, the founder of Tulsa Innovation Labs, said that much of the Tulsa tech scene was built with inclusion in mind and that the executive order is “counterproductive.”

He moved to Tulsa in 2020 to work for the George Kaiser Family Foundation, a major investor in much of Tulsa’s tech scene. He then went on to launch Tulsa Innovation Labs to increase opportunities for entrepreneurs in the city. Though he has since left Tulsa Innovation Labs, he said diversity, equity and inclusion were always part of its founding mission. There is underlying tension simmering between Tulsa’s tech hub and the governor’s office, he said, and the executive order could possibly harm Oklahoma’s economic prospects.

“Especially for a state that already struggles with perception issues around inclusion,” he said, “the order does nothing to create jobs for Oklahomans, and worse, it sends the wrong message to outside tech talent and investors. Diversity is a core attribute of a thriving innovation economy.”

But what about the Black Wall Street neighborhood? Would a DEI backlash affect the efforts to rebuild? Kelsey Davis, a founder of the hiring platform Cllctve, said Black Wall Street will continue to rebuild itself and leverage the knowledge and wisdom that has sustained it this long despite the century of racist attacks it has faced. Davis moved to Tulsa two years ago and bought a house on Black Wall Street, looking to build value and equity in the local community.

The area has seen changes, she said, and the anti-DEI backlash can only hurt if it makes people divest from fighting for equity in their own communities. “It’s necessary that we examine ourselves to ask what we are individually doing to help restore and maintain the freedom and access toward wealth creation that our ancestors had 103 years ago before the massacre,” she said. “We must also continue to consider what economic liberties were sacrificed for social progress and reevaluate how to achieve both in this modern era.”

For the most part, though, and for many, it’s just business as usual. “Local leaders can’t get distracted or discouraged by naysayers,” Lalla said. “Tulsa just needs to keep doing what it’s doing.”

Detail of shipping container door

Software supply chain security remains a challenge for most enterprises

by with No Comment Tech

Detail of shipping container door

Image Credits: Busà Photography / Getty Images

Log4j, maybe more than any other security issue in recent years, thrust software supply chain security into the limelight, with even the White House weighing in. But even though virtually every technology executive is at least aware of the importance of creating a trustworthy and secure software supply chain, most continue to struggle with how to best implement a strategy around it.

The number of CVEs (Common Vulnerabilities and Exposures) continues to increase at a steady pace and there’s nary a container out there that doesn’t include at least some vulnerabilities. Some of those may be in libraries that aren’t even used when the container is in production, but they are vulnerabilities nevertheless.

Image Credits: Slim.ai

According to Slim.ai‘s latest Container Report, the average organization now deploys well over 50 containers from their vendors every month (and almost 10% deploy more than 250). Yet only 12% of the security leaders who responded to Slim.ai’s survey said they were able to achieve their own vulnerability remediation goals. Everybody else says they are “greatly” struggling or see significant room for improvement. And while those organizations are all pressuring their vendors to improve their security stance and deliver, the vendors and buyers often can’t even agree on which CVE’s actually need patching in a container.

As Ayse Kaya, Slim.ai’s VP for Strategic Insights and Analytics told me, the interaction between buyers and vendors is often still driven by the exchange of spreadsheets and ad hoc meetings between security groups. According to the company’s report, which it created in partnership with research firm Enterprise Strategy Group, that’s still how 75% of organizations exchange information with their vendors, even as virtually all security leaders (84%) would look to see a centralized collaboration platform for managing vulnerabilities. For the time being, though, it seems like emailing spreadsheets back and forth remains to be the state of the art.

Image Credits: Slim.ai

All of this inevitably leads to inefficiencies. The majority of organizations that responded to the survey said they employ six or more specialists who focus on vulnerability remediation (with a quarter of respondents employing more than 10). One of the major problems in the industry is that more than 40% of the alerts these teams get are false positives — often for libraries that may be part of a container but aren’t used in production. Because of this, Kaya for example greatly advocates for creating minimal container images. One could argue that this should be a best practice anyway, since it creates a smaller attack surface and reduces false positives.

It’s not just security teams that have to deal with these vulnerabilities, though, of course. All of these efforts slow down the overall development process, too. Most companies see some disruptions multiple times a week because they detect a vulnerability in a production container, for example. According to Slim.ai’s report, the average container now sees a new release roughly every 11 days and the average container is now affected by 311 CVEs (up from 282 in 2022). All of that means more work, more interruptions and more effort expended in working with vendors to get them fixed.

The downtown Tulsa Skyline from across the Arkansas River at dusk.

Tulsa's tech scene remains resilient amid state's anti-DEI efforts

by with No Comment Tech

The downtown Tulsa Skyline from across the Arkansas River at dusk.

Image Credits: chrisp0 / Getty Images

Oklahoma took a stand against diversity, equity and inclusion (DEI) last month. The state’s governor, Kevin Stitt, signed an executive order defunding DEI efforts in public colleges and universities and banning it in other state agencies.

He said the move would take “politics out of education” and encourage “equal opportunity rather than promising equal outcomes.” Affirmative action itself has been banned in the state since 2012.

This latest executive order does not target student organizations, but it does ban state resources from being used for diversity training and asks for a review of current DEI programs to eliminate any “non-critical personnel.” Oklahoma is following in the footsteps of Florida, Texas, South Dakota, North Carolina and Tennessee in attempting to curb DEI initiatives at public colleges.

But public colleges aren’t the only ones being affected; this is part of a broader backlash to DEI that has become prevalent in many industries, from technology to academia to fashion. Supporters of DEI say these initiatives help everyone get ahead, especially marginalized communities that have been historically disenfranchised. Critics call DEI-related work a form of discrimination.

The hard-line stance Oklahoma has taken against DEI is at odds with the efforts of its Tulsa tech hub. For the past decade, Tulsa has been trying to attract talent from all over the nation. It’s also, most notably, trying to rebuild Black Wall Street, a once-prosperous Black business neighborhood that white supremacists bombed in the 1920s.

Tulsa is trying to build a startup ecosystem from scratch

Tré Baker, managing director at Tulsa Techstars, said that the executive order does not materially change business on the ground. The city’s ecosystem has become accustomed to dealing with constraints since affirmative action was banned in the state back in 2012. The government also has no control over private investment decisions. He said it’s as simple as not publicly announcing any preference for one group over another.

“The problem is not the law, the problem has always been people making investment decisions,” he said. “When we empower more Black investors, more Black founders will get funded.”

Still, others are afraid this could dampen the appeal of Tulsa that attracted people to the city in the first place. Nicholas Lalla, the founder of Tulsa Innovation Labs, said that much of the Tulsa tech scene was built with inclusion in mind and that the executive order is “counterproductive.”

He moved to Tulsa in 2020 to work for the George Kaiser Family Foundation, a major investor in much of Tulsa’s tech scene. He then went on to launch Tulsa Innovation Labs to increase opportunities for entrepreneurs in the city. Though he has since left Tulsa Innovation Labs, he said diversity, equity and inclusion were always part of its founding mission. There is underlying tension simmering between Tulsa’s tech hub and the governor’s office, he said, and the executive order could possibly harm Oklahoma’s economic prospects.

“Especially for a state that already struggles with perception issues around inclusion,” he said, “the order does nothing to create jobs for Oklahomans, and worse, it sends the wrong message to outside tech talent and investors. Diversity is a core attribute of a thriving innovation economy.”

But what about the Black Wall Street neighborhood? Would a DEI backlash affect the efforts to rebuild? Kelsey Davis, a founder of the hiring platform Cllctve, said Black Wall Street will continue to rebuild itself and leverage the knowledge and wisdom that has sustained it this long despite the century of racist attacks it has faced. Davis moved to Tulsa two years ago and bought a house on Black Wall Street, looking to build value and equity in the local community.

The area has seen changes, she said, and the anti-DEI backlash can only hurt if it makes people divest from fighting for equity in their own communities. “It’s necessary that we examine ourselves to ask what we are individually doing to help restore and maintain the freedom and access toward wealth creation that our ancestors had 103 years ago before the massacre,” she said. “We must also continue to consider what economic liberties were sacrificed for social progress and reevaluate how to achieve both in this modern era.”

For the most part, though, and for many, it’s just business as usual. “Local leaders can’t get distracted or discouraged by naysayers,” Lalla said. “Tulsa just needs to keep doing what it’s doing.”