OX Security launches OSC&R
OX security, the first end-to-end software supply chain security solution, recently announced the launch of OSC&R (Open Software Supply Chain Attack Reference), the first and only open framework for evaluating and understanding current threats to entire supply chain security.
Talks with hundreds of industry leaders disclosed an urgent need for a MITRE-like framework that would let experts better understand and evaluate supply chain risk, a process that to date was only based on experience and intuition. OSC&R is built to give a common language and structure for analyzing and understanding TTPs- tactics, techniques, and procedures used by threat actors to disrupt the security of software supply chains.
Dark Reading reports, "The founding consortium of cybersecurity leaders behind OSC&R include David Cross, former Microsoft, and Google cloud security executive; Neatsun Ziv, Co-Founder and CEO of OX Security; Lior Arzi, Co-Founder and CPO at OX Security; Hiroki Suezawa, Senior Security Engineer at GitLab; Eyal Paz, Head of Research at OX Security; Phil Quade, former CISO at Fortinet; Dr. Chenxi Wang, former OWASP Global Board member; Shai Sivan, CISO at Kaltura; Naor Penso, Head of Product Security at FICO; and Roy Feintuch, former Cloud CTO at Check Point Technologies."
How does OX Security work?
OSC&R is now ready for use by security teams to analyze existing defenses and define which threats need to be addressed first, how existing coverage deals with these threats, and also to help in behavior tracking of threat actor groups.
Hiroki Suezawa, Senior Security Engineer at Gitlab said "OSC&R helps security teams build their security strategy with confidence. We wanted to give the security community a single point of reference to proactively assess their own strategies for securing their software supply chains and to compare solutions,"
The OSC&R framework in OX Security
The OSC&R framework will update as new techniques and strategies will evolve and emerge. It will also help red-teaming activities by setting the scope needed for a red team or pentest exercise, serving as a scorecard. The framework will also be open for other cybersecurity experts and leaders who can offer help to OSC&R.
"Trying to talk about supply chain security without a common understanding of what constitutes the software supply chain isn't productive. Without an agreed-upon definition of the software supply chain, security strategies are often siloed," said Neatsun Ziv, who also worked as Check Point's VP of Cyber Security before founding OX.
About OX Security
OX Security believes that security must be at the core of the software development process, not an afterthought. It stops attacks across your software supply chain. Automatically block risks introduced into the pipeline and ensure the integrity of each workload, all from a single location.
It provides complete visibility and end-to-end traceability over your software pipeline security from cloud to code. OX security also helps you manage your findings, orchestrate DevSecOps activities, prevent risks, and maintain software pipeline integrity from a single location.