Amazon’s recent report attributing a series of compromises of open source software libraries to a North Korea-backed threat group encapsulates many of the expanding cyber risks increasingly facing developers, from the growing use of generative AI by bad actors and targeting of code repositories to financially focused attacks by nation-state hackers and the abuse of trust by development teams. It also is the latest report to point to the group – known by such names as Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon, and Alluring Pisces – linked to the Democratic People’s Republic of Korea (DPRK) to supply chain attacks over the past couple of years that involve placing malicious code into packages in the npm repository. “When an attacker compromises a widely used open source package, every organization that depends on that package is potentially affected,” CJ Moses, CISO of Amazon Integrated Security, wrote in the report , adding that they have “observed the volume and s...
Both SMBs and large enterprises often choose software development outsourcing over developing software in-house. It is no surprise, as partnering with external developers enables companies to bridge IT talent gaps that cannot be filled internally, avoid time-consuming recruiting and training processes, and eliminate expenses associated with salaries and benefits, eventually accelerating software delivery and reducing development costs. While software development outsourcing can be highly advantageous from the business perspective, it also introduces various risks, ranging from diminished project control to provider lock-in and security-related issues. Managing these risks proactively is critical to preventing them from escalating, minimizing their impact on the project timeline, budget, and software quality, and ensuring smoother project execution. In this article, experts from Itransition, an outsourcing partner with over 25 years of experience, outline common risks of outsourcing ...