How to Use Code Signing to Protect your Critical Software
summary
Maersk’s NotPetya chain shows supply‑chain risk: Link OS compromise lets malware spread to 4,000 servers and 45,000 PCs, costing ~$300M internally and an estimated ~$10B globally. Asus attackers steal two private signing keys on an update server and push signed malware to ~1M machines. McAfee finds ~22.5M signed malware samples. Practical defenses: keep private keys in an HSM or secure vault so keys never leave, require approval workflows and audit trails, integrate signing into CI with developer‑friendly automation and global visibility.
AI-written summary · about
chapters (10)
- 0:00A.P. Møller-Maersk World's Largest Shipping Conglomerate
- 1:57Global Havoc and Damage
- 2:32HOW DID IT HAPPEN?
- 6:10Malware Infection from Poor Code Signing Practices VENAFI
- 8:29What Is Code Signing?
- 9:45Who signs code?
- 12:311/ Code signing is effective, but...
- 15:48The Mechanics of Operation ShadowHammer
- 17:41The Impact of Operation ShadowHammer
- 22:161/5 Best Practicies
related talks
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
30mMalicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses
46mThe Rise of Malware Within the Software Supply Chain
58mAttacking through the Software Supply Chain
31mThe internet is broken: breaking down the software supply chain
52mLessons Learned from the Summer of Supply Chain Attacks
15mSoftware Supply Chain Security for those in a rush
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack