Know Where Code Is Coming From

The SolarWinds attack has prompted businesses to question the security of the build cycle and scrutinize where they’re getting code from as well as the applications they’re using, according to Mary O’Brien, general manager of IBM Security. Specifically, O’Brien said customers have become more sensitive to where their code is coming from as well as regulating what code is used within the development cycle.

In a post-SolarWinds world, businesses should also put guardrails around their code vaults and protect it like they would a significant database since it’s clear the code repository should be considered a crown jewel, O’Brien said. The SolarWinds attack made it clear the chaos hackers can cause by getting deep into the development cycle, and drove awareness of just how sophisticated and patient they can be.

O’Brien said she’s seen huge levels of investment in recent months around vulnerability assessments, with company bringing in security experts to analyze the maturity of their operations and look for holes and openings. She also urged businesses to invest in network segmentation to minimize the amount of lateral movement that can occur in the event a company is successfully breached.