Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The JFrog Security Research team continuously monitors reported vulnerabilities in open-source software (OSS) to help our customers and the wider community be aware of potential software supply chain security threats and their impact. In doing so, we often notice important trends and key learnings worth highlighting.

The buzz around decentralized clinical trials, or DCT, has captured the attention of organizations across the clinical research industry, prompting no small degree of excitement, apprehension, and speculation. DCT has some in the industry cheering, some biting their nails, and others scratching their heads. But what exactly does DCT mean—and will it truly change clinical research?

Whenever engineers discover a new security issue, the question arises every time: is this an exploit or vulnerability? What is a software vulnerability? How does it differ from an exploit? A vulnerability is a gap in the armor or weakness that allows people to enter. The exploit is the mechanism that someone uses to get in. For example, a door with a fragile lock has a vulnerability. The exploit uses the keys, hammer, or lockpick to break the lock.

Cyber perpetrators don’t leave a single stone unturned when discovering security loopholes, no matter how thin their chances of success are. That’s why authorities such as CA/B Forum must stay a step ahead, tighten their policies and minimize security breaches. One such change is occurring from November 15, related to OV Code Signing Certificates. From November 15, 2022, OV code signing certificates will require a hardware security module to store their private key.