Below the Surface (Audio) - The Supply Chain Security Podcast

In this episode of Below the Surface, Paul Asadoorian, Vlad Babkin, and Adrian Sanabria discuss the ongoing vulnerabilities in network edge devices, the implications of legacy systems like Avanti, and the strategies employed by threat actors. They explore the importance of monitoring and detection in cybersecurity, as well as innovative deception techniques to enhance security measures against exploitation. In this conversation, the speakers delve into various aspects of cybersecurity, including innovative strategies to enhance security, the challenges posed by vendor cooperation, the implications of cyber insurance, and the importance of visibility in threat detection. They discuss the use of canary tokens, the exploitation of edge devices, and the reality of zero-day vulnerabilities. The conversation also touches on the need for firmware updates, the shift towards open-source solutions, and the role of AI in developing cybersecurity tools. Chapters   00:00 Introduction to Below the Surface Podcast 03:27 Network Edge Vulnerabilities and Trends 10:02 Understanding Avanti and Its Impact 12:44 The Consequences of Legacy Systems 18:03 Exploitation Techniques and Threat Actor Strategies 26:50 The Importance of Monitoring and Detection 31:14 Deception Techniques for Enhanced Security 32:55 Leveraging Canary Tokens for Enhanced Security 34:41 The Challenge of Vendor Cooperation in Cybersecurity 35:30 Understanding Cyber Insurance and Its Implications 36:25 The Importance of Visibility in Cyber Defense 39:12 Utilizing Low-Interaction Honeypots for Threat Intelligence 41:48 Exploiting Vulnerabilities in Edge Devices 43:27 The Reality of Zero-Day Vulnerabilities 45:04 Analyzing Recent Exploits in Network Devices 49:02 The Need for Firmware Updates and Alternatives 50:33 Exploring Tailscale and Remote Access Solutions 54:33 Building Secure Lab Environments 56:52 The Shift Towards Open Source in Cybersecurity 01:00:27 Innovations in Memory Forensics 01:03:02 AI's Role in Enhancing Cybersecurity Tools  

In this episode, the hosts discuss various cybersecurity threats, including Russian cyber attacks on critical infrastructure, the vulnerabilities in firewalls and VPNs, and the implications of AI in cybersecurity. They explore the increasing trend of using Python for malicious purposes and the challenges posed by gaming anti-cheat drivers. The conversation also touches on the escalation of cyber warfare and the confused deputy problem in AI, highlighting the need for better security measures and awareness in the industry. Chapters   00:00 Introduction to Cybersecurity Threats 02:52 Russian Cyber Attacks on Poland's Power Grid 10:33 The Flaws in Firewall Security 15:02 AI and the Future of Cybersecurity 22:22 Exploiting Vulnerabilities in Gaming Anti-Cheat Drivers 29:47 Driver Attestation and Security Transparency 35:17 Critical Infrastructure and Cybersecurity Threats 39:50 Linux Malware and Python Exploits 45:47 Firmware Complexity and Security Risks 51:19 Cyber Insurance and Responsibility in Cybersecurity 56:52 Confused Deputy Attack and AI Security Risks

In this episode, the hosts discuss various cybersecurity topics, including the challenges of BIOS password cracking, the implications of AMD's Stack Warp vulnerability, and the importance of up-to-date secure boot certificates. They also explore the risks associated with network security appliances, the costs of cybersecurity, and the role of marketing in raising awareness. Additionally, they share insights from an X-ray analysis of USB cables, highlighting the differences between quality and counterfeit products.   BIOS password cracking can be complex and time-consuming. Physical access to hardware can significantly impact security measures. The Stack Warp vulnerability poses serious risks to virtual machines. Secure boot certificates need regular updates to maintain security. Network security appliances can introduce new vulnerabilities. Cybersecurity costs often outweigh the perceived benefits of cloud solutions. Marketing plays a crucial role in raising awareness about cybersecurity issues. X-ray analysis can reveal the quality of electronic components. Understanding the shared responsibility model is essential for IT teams. The balance between security and operational efficiency is a constant challenge.   Chapters 01:59 Introduction to Below the Surface Podcast 04:46 BIOS Password Cracking Techniques 10:14 Exploring AMD's Stack Warp Vulnerability 22:03 Migration Trends in Cloud Computing 23:22 Cost vs. Security in On-Premises Solutions 24:37 Shared Responsibility in Network Security Appliances 27:03 The Risks of Network Security Appliances 28:14 Exploitation of Vulnerabilities in Network Devices 31:18 Challenges in Updating Network Security Appliances 34:59 The Slow Response to Vulnerabilities 39:05 The Complexity of Firmware Updates 45:45 Secure Boot Certificates and Future Vulnerabilities 49:12 Fun Innovations: X-ray Machine in the Office  

In this episode of Below the Surface, host Paul Asadoorian is joined by co-hosts Larry Pesci, Joshua Marpet, and Vlad Babkin to delve into the complexities of hardware supply chain security. The discussion is sparked by a presentation from Andrew 'Bunny' Wong at Black Hat Asia, which raised critical questions about how we can trust the silicon in our devices. The conversation explores the challenges of validating hardware components, the potential for backdoors in devices, and the implications of counterfeit components in the supply chain. The hosts share anecdotes and insights about their experiences with hardware security, emphasizing the need for independent testing and the importance of understanding the provenance of hardware components. 00:00 Introduction to Hardware Supply Chain Security 02:53 Understanding Trust in Silicon 05:55 Challenges in Validating Hardware Components 09:01 Historical Context of Hardware Tampering 11:58 The Complexity of Supply Chains 14:55 Operationalizing Hardware Validation 18:01 The Role of Independent Researchers 20:59 Bounties and Community Involvement 23:56 Innovative Techniques for Hardware Analysis 27:06 The Future of Hardware Security 31:57 The Evolution of Computing: From Transistors to Quantum 36:11 Understanding Hardware Trust and Supply Chain Risks 41:52 The Need for Continuous Monitoring and Assurance 55:31 The Future of High Assurance Devices and Backdoors  

Summary In this episode, special guest Matt Brown joins us to discuss the integration of AI in firmware analysis, exploring its benefits and challenges. We delve into the transition from traditional methods to AI-driven approaches, emphasizing the importance of prompt specificity for effective vulnerability discovery. The conversation also covers the role of open-source components, the need for guardrails in AI use, and the implications of AI-generated reports in cybersecurity. Additionally, they touch on man-in-the-middle techniques and the future of AI in firmware development, highlighting the creative monetization of vulnerabilities in IoT devices. Takeaways * AI is revolutionizing firmware analysis and vulnerability discovery. * Specificity in prompts is crucial for effective AI usage. * Open-source components can enhance analysis results significantly. * Guardrails are necessary to prevent AI from executing harmful commands. * AI can assist in code refactoring and documentation generation. * NTP spoofing can reveal vulnerabilities in time-sensitive applications. * AI-generated reports may lead to false positives in vulnerability assessments. * Man-in-the-middle techniques are essential for testing device security. * The future of AI in firmware development is promising but complex. * Understanding the context of vulnerabilities is key to accurate reporting. Chapters 00:00 Introduction to Firmware Analysis and AI Tools 01:54 Transitioning from Traditional Tools to AI 04:28 Specific Techniques for Vulnerability Discovery 06:29 Dynamic Analysis vs. Static Analysis 08:30 Using AI for Code Generation and Documentation 11:43 Interacting with Firmware and Devices 15:57 Creating Custom Tools and Skills for AI 18:53 Recent Projects and Use Cases in Firmware Analysis 22:48 Challenges and Risks of Using AI in Security Research 28:36 The Future of AI in Firmware Development 29:43 AI in Code Review and Vulnerability Detection 33:35 Limitations of AI in Understanding Logic 37:54 Challenges with AI-Generated Vulnerability Reports 43:13 Man-in-the-Middle Techniques and Tools 53:24 Exploring IoT Device Vulnerabilities

Summary In this episode, the hosts discuss various cybersecurity topics, including recent vulnerabilities in Fortinet products, the implications of supply chain breaches, the evolving role of AI in cybersecurity, and updates to the OWASP Top 10 list. They emphasize the importance of firmware security and the need for better visibility and standards in the industry. The conversation highlights the challenges faced by defenders in a rapidly changing threat landscape and the necessity for proactive measures to secure systems. Takeaways Fortinet vulnerabilities are critical and require immediate attention. Silent patches can lead to significant security risks. AI is being used by both attackers and defenders in cybersecurity. The OWASP Top 10 has been updated to include software supply chain failures. Firmware security is often overlooked but is essential for device safety. Supply chain breaches can have far-reaching implications for organizations. Visibility into firmware and device security is lacking in the industry. Standards for software security are necessary to protect against vulnerabilities. Defenders need better tools to combat evolving threats. The cybersecurity landscape is becoming increasingly complex and interconnected. Chapters 00:00 Introduction and Technical Setup 03:08 Fortinet Vulnerabilities and Exploits 06:05 Public Exploits and Path Traversal Vulnerabilities 09:00 Chaining Vulnerabilities and Risk Assessment 11:50 Authentication and Vulnerability Scoring 15:04 Operational Complexity in Patch Management 17:55 Silent Patches and Their Implications 20:58 Challenges with Network Device Security 24:55 Cyber Insurance and Vulnerability Trends 27:58 The Impact of Silent Patches 30:46 End of Life Devices and Legacy Systems 34:58 Supply Chain Security and Source Code Theft 39:44 AI in Cybersecurity: Opportunities and Threats 47:17 Navigating AI's Guardrails and Malicious Use Cases 49:24 The Dilemma of AI and Harmful Intentions 52:44 The Need for Researcher Access to AI Tools 58:36 OWASP Top 10 Updates and Supply Chain Security 01:05:12 The Challenges of Firmware and Device Security

Summary   In this episode of Below the Surface, Paul Asadoorian and Chase Snyder delve into various cybersecurity topics, including the use of Raspberry Pi in cyber attacks, the implications of the F5 breach, and the emergence of Polar Edge malware targeting QNAP devices. They also discuss the innovative Two-Face Rust binary technique, the critical nature of authentication bypass vulnerabilities, and the evolving landscape of air-gapped systems. The conversation highlights the increasing risk posed by old vulnerabilities and the need for improved security measures in the face of advancing cyber threats.   Articles:   https://reporter.deepspecter.com/f5-is-misleading-the-market-the-breach-is-nowhere-near-contained-a766d932c582  https://blog.sekoia.io/polaredge-backdoor-qnap-cve-2023-20118-analysis/ https://www.group-ib.com/blog/unc2891-bank-heist/  https://www.synacktiv.com/en/publications/creating-a-two-face-rust-binary-on-linux  https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities https://www.trendmicro.com/en_us/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html  

In this episode, the hosts discuss the recent F5 breach, exploring the implications of the attack, the tactics used by threat actors, and the importance of vulnerability disclosure. They delve into the complexities of securing network edge devices, the challenges posed by Linux security, and the need for standardization in security practices. The conversation also touches on the future of firmware security and the necessity for proactive measures in incident response. We also close out the show taking about the recent Framework UEFI shell vulnerability. Chapters   00:00 Introduction to F5 Breach and UEFI Secure Boot Bypass 02:16 Details of the F5 Breach 04:59 Threat Actor Analysis and Implications 07:18 Vulnerability Disclosure and Exploitation Risks 10:17 Security Measures and Key Management 12:57 Proactive Defense Strategies 15:52 The Evolving Threat Landscape 18:41 Challenges in Securing Network Devices 21:10 Linux Security and Customization Issues 25:16 Kernel Customization Challenges 27:08 Security Through Obscurity 29:04 Application Security and Development Practices 33:59 Framework's UEFI Shell Vulnerability 38:22 Interdependency in Technology Ecosystems 41:48 The Need for Transparency in Signed Software  

In this episode of Below the Surface, the hosts discuss various cybersecurity topics, including the Red November campaign targeting network edge devices, the implications of the Cisco SNMP vulnerability, and the recent vulnerabilities associated with Cisco ASA devices. They also delve into the hybrid Petya ransomware and its connection to supply chain security, emphasizing the need for better visibility and security measures in network devices. Chapters: 00:00 Introduction and Overview of Cybersecurity Trends 02:09 Red November Campaign: Targeting Network Edge Devices 11:06 The Shift in Attack Vectors: From Windows to Network Edge 14:59 Cisco SNMP Vulnerability: A Legacy Issue 21:21 The Implications of Targeting Network Edge Devices 28:20 Addressing Legacy Issues in Cybersecurity 29:41 Emerging Threats in Cybersecurity 32:19 The Age of Vulnerabilities 33:40 The Importance of Asset Inventory 35:38 Challenges in Device Security 37:22 Visibility and Detection Limitations 39:28 Vendor Responses to Vulnerabilities 41:24 Supply Chain Security Crisis 46:59 Understanding Hybrid Petya 52:11 The Evolution of Attack Techniques  

In this episode of Below the Surface, the hosts discuss various cybersecurity topics, including the evolution of malware with a focus on Hybrid Petya, the implications of UEFI vulnerabilities, and the security risks associated with Windows 10's end of life. They also explore the vulnerabilities of Cisco ASA devices, the rise of supply chain attacks exemplified by NPM worms, and the persistent threat of Row Hammer attacks on DDR5 technology. The conversation highlights the significance of visibility in cybersecurity and the necessity for enhanced security practices to counter evolving threats. Chapters   00:00 Introduction and Podcast Overview 02:55 Hybrid Petya: The New Threat Landscape 06:03 Understanding UEFI and Secure Boot Vulnerabilities 09:00 The Evolution of Ransomware Techniques 11:54 Windows 10 End of Life Concerns 14:56 The Future of Secure Boot and User Responsibility 22:50 The Shift in Consumer Trust Towards Microsoft 25:11 The Rise of Alternatives: Linux and SteamOS 28:41 Security Concerns with Windows 10 and 11 31:57 Exploiting End-of-Life Devices 36:39 The Challenge of Legacy Infrastructure 39:41 VPN Security: Risks and Solutions 45:40 The Dilemma of Compliance and Visibility 50:16 Supply Chain Vulnerabilities and NPM Attacks 55:54 The Rowhammer Attack and Hardware Security 01:03:40 The Need for Visibility and Signatures in Security  

In this episode of Below the Surface, host Paul Asadoorian speaks with Evan Dornbush, CEO of Desired Effect, about the evolving landscape of exploit marketplaces and vulnerability research. They discuss the challenges researchers face in monetizing their findings, the ethical implications of selling exploits, and the importance of timely intelligence for defenders. The conversation also touches on the role of AI in vulnerability research, the dynamics between buyers and sellers in the marketplace, and the impact of end-of-life devices on cybersecurity. Overall, the episode provides valuable insights into the complexities of the exploit marketplace and the need for a more proactive approach to cybersecurity.   Chapters   00:00 Introduction to Desired Effect and Evan Dornbush 02:35 The Evolution of Exploit Marketplaces 05:06 Monetizing Vulnerability Research 07:46 The Role of Disclosure in Exploit Sales 10:28 Understanding the Value of Exploits 13:14 Ethics and Motivations in Vulnerability Research 15:51 Validation of Vulnerabilities and Exploits 18:29 Buyer Vetting and Market Dynamics 21:31 Proactive Defense Strategies 24:32 Market Insights and Future Trends 27:43 The Marketplace for Exploits 31:08 The Role of Researchers and Vendors 34:51 The Asymmetry in Cybersecurity 38:03 Economic Incentives in Cybersecurity 40:25 The Complexity of Risk Management 43:57 The Future of Exploit Disclosure 47:23 The Role of AI in Cybersecurity 53:31 Closing Thoughts on Exploit Ethics  

In this episode, the hosts discuss various cybersecurity topics, focusing on hardware vulnerabilities, UEFI attack vectors, and the implications of new regulations on device security. They explore the evolution of Mirai variants targeting IoT devices and the challenges of securing firmware. The conversation highlights the need for improved security measures and the complexities of managing vulnerabilities in a rapidly changing technological landscape.   00:00 Introduction and Technical Challenges 02:37 Exploring UEFI Settings and Hardware Vulnerabilities 10:14 The Risks of UEFI Control and Physical Damage 16:33 Static Tundra: Cyber Espionage and Exploits 22:23 Targeting Vulnerable Infrastructure in Cyber Attacks 26:27 Emerging Threats in IoT and Network Devices 31:55 The Evolution of Malware: A Deep Dive 34:30 The Challenge of Securing IoT Devices 35:13 Impact of EU Cyber Resilience Act 38:14 Vulnerability Management and Vendor Responsibilities 41:54 Living Outside the Operating System: New Attack Vectors  

In this episode of Below the Surface, host Paul Asadoorian is joined by Brian Mullen, head of SSDLC at AMI, to discuss the complexities of supply chain and firmware security. They explore the challenges of maintaining security in a complicated supply chain, the importance of proactive and reactive security measures, and the implications of end-of-life software. The conversation also touches on the gaming industry's push for secure boot, recent vulnerabilities discovered in firmware, and the role of BMCs in security. Brian shares insights into AMI's approach to vulnerability management and the future of firmware security, including the significance of Software Bill of Materials (SBOMs). Whitepaper: https://eclypsium.com/wp-content/uploads/OpenBMC-Security-in-Practice.pdf  Chapters 00:00 Introduction and Technical Setup 01:46 The Challenges of Podcasting and Marketing 03:42 Understanding AMI and Its Role in Firmware Security 06:13 Supply Chain Complexity and Security Measures 08:49 Proactive vs Reactive Security in Firmware 11:17 The Importance of Stable Firmware in Security 13:54 Navigating Vulnerabilities in UEFI and OpenSSL 16:24 The Impact of Cherry-Picking Security Updates 19:11 Tracking Vulnerabilities Across the Supply Chain 21:50 Solutions for Data Center Firmware Management 24:21 Future Directions in Vulnerability Management 24:38 Navigating Vulnerability Management 28:30 End of Life and Support Challenges 31:55 Gaming Security and Anti-Cheat Mechanisms 35:38 The Complexity of Secure Boot Implementation 36:50 Recent Vulnerabilities and Security Research 39:44 Understanding BMC Security 43:34 Open Source and BMC Development 46:30 The Role of SBOMs in Security Compliance

In this episode, the hosts discuss various cybersecurity topics, focusing on Nvidia vulnerabilities, the implications of backdoors in technology, and the importance of secure boot and certificate management. They also delve into SonicWall's security challenges and the ongoing debate of building versus buying security solutions, particularly in the context of AI infrastructure and cloud services. Articles and topics for this week:   https://blog.trailofbits.com/2025/08/04/uncovering-memory-corruption-in-nvidia-triton-as-a-new-hire/ https://mjg59.dreamwidth.org/72892.html - Secure Boot and certificates https://www.tomshardware.com/pc-components/gpus/nvidia-defiant-over-backdoors-and-kill-switches-in-gpus-as-u-s-mulls-tracking-requirements-calls-them-permanent-flaws-that-are-a-gift-to-hackers -  https://www.bleepingcomputer.com/news/security/sonicwall-urges-admins-to-disable-sslvpn-amid-rising-attacks/ -  https://www.darkreading.com/endpoint-security/shade-bios-technique-beats-security -  Researcher's previous paper on SMM and malware: https://arxiv.org/abs/2405.04355  He presented at Blackhat last year on Option ROMS: https://www.blackhat.com/us-24/briefings/schedule/index.html#youve-already-been-hacked-what-if-there-is-a-backdoor-in-your-uefi-orom-39579 - YouTube video: https://www.youtube.com/watch?v=_S6EymfaBqQ   

In this episode of Below the Surface, the hosts discuss critical cybersecurity topics including vulnerabilities in Netgear and Gigabyte devices, the importance of asset inventory, and the implications of Row Hammer attacks on memory integrity. They emphasize the need for organizations to implement compensating controls and monitor for potential threats, especially in the context of supply chain security and IoT devices.   Chapters   00:00 Introduction to Cybersecurity Challenges 02:20 Exploring Netgear's Role in Enterprise Security 09:08 The Impact of Shadow IT on Network Security 15:04 Firmware Integrity and Security Measures 18:05 Gigabyte's UEFI Vulnerabilities and Industry Implications 22:25 Understanding UEFI Vulnerabilities 28:46 Consumer vs. Enterprise Hardware Security 35:06 Monitoring and Mitigating Firmware Risks 41:11 The Impact of ECC on AI Performance  

In this episode, the hosts delve into the critical vulnerabilities associated with Baseboard Management Controllers (BMCs), with a particular focus on CVE-2024-54085. They discuss the ease of exploitation, the potential threat actors involved, and the implications for data center security. The conversation highlights the challenges in detecting and mitigating these vulnerabilities, the importance of firmware updates, and the need for community tools to aid in vulnerability detection and mitigation. The episode concludes with a call to action for organizations to patch their systems and implement robust security measures. Chapters   00:00 Introduction to BMC Vulnerabilities 02:21 Exploring CVE 2024-54085 05:04 Understanding Exploitation and Threat Actors 07:47 The Implications of BMC Vulnerabilities 10:46 Mitigation Strategies and Challenges 13:35 The Future of BMC Security 28:36 Understanding BMC Vulnerabilities 36:24 The Importance of Disclosure and Community Tools 45:13 Navigating Firmware Updates and Vendor Challenges 52:19 Community Engagement and Future Considerations  

In this episode, the hosts discuss the evolving landscape of AI infrastructure security, focusing on the complexities of building and maintaining AI data centers. They explore the critical role of Baseboard Management Controllers (BMCs) as an attack surface, the importance of supply chain security, and best practices for hardware procurement. The conversation underscores the importance of validating hardware and firmware integrity for organizations while also addressing the significant security risks associated with AI workloads. As AI data centers continue to grow, understanding these challenges and implementing robust security measures will be essential for future success. Chapters   00:00 Introduction to Zero Trust and Its Evolution 03:33 Current State of Zero Trust Implementation 05:22 Micro-Segmentation and Infrastructure Security 10:02 Zero Trust and Lateral Movement Prevention 11:32 The Role of Zero Trust in Ransomware Defense 14:51 Chase Cunningham's Insights on Cyber Warfare 16:23 The Intersection of Cyber Warfare and Modern Conflicts 21:35 The Future of Warfare: Drones and Cybersecurity 24:01 Understanding the Drone Threat 28:28 The Evolution of Cyber Warfare 35:00 The State of Critical Infrastructure 39:26 The Economics of Breaches 44:29 Incentivizing Cybersecurity Improvements  

In this episode, the hosts discuss the evolving landscape of AI infrastructure security, focusing on the complexities of building and maintaining AI data centers. They explore the critical role of Baseboard Management Controllers (BMCs) as an attack surface, the importance of supply chain security, and best practices for hardware procurement. The conversation underscores the importance of validating hardware and firmware integrity for organizations while also addressing the significant security risks associated with AI workloads. As AI data centers continue to grow, understanding these challenges and implementing robust security measures will be essential for future success.

In this episode, the hosts discuss the impending end of life for Windows 10 and the necessary preparations for upgrading to Windows 11. They explore the specific hardware requirements for Windows 11, including the importance of Secure Boot and TPM 2.0, and the challenges enterprises face in managing large-scale migrations. The conversation underscores the importance of meticulous planning to prevent costly failures and the influence of legacy systems on the upgrade process. In this conversation, the speakers discuss the implications of transitioning to Windows 11, focusing on the challenges posed by legacy systems, supply chain issues, and the importance of modern hardware for security. They delve into the Black Lotus UEFI boot kit and the necessary mitigations, emphasizing the need for organizations to validate their security controls and establish a robust trust framework. The discussion also highlights the growing importance of third-party risk management in cybersecurity, particularly in relation to supply chain security.  

Summary In this episode, Paul Asadoorian and Joshua Marpet delve into the complexities of compliance, inventory management, and the emerging concepts of SBOMs, HBOMs, and FBOMs (no, not that FBOM). They discuss the importance of understanding the components and origins of hardware and software, the challenges of managing technology lifecycles, and the need for clear standards and regulations in the tech industry. The conversation emphasizes the critical role of asset inventories in maintaining security and compliance in an ever-evolving technological landscape. In this conversation, Joshua Marpet and Paul Asadoorian delve into the complexities of hardware security, the cultural shifts needed in security practices, and the importance of transparency in software and firmware management. They discuss the challenges posed by hardware backdoors, the necessity of Software Bill of Materials (SBOMs), and the hidden risks associated with firmware updates. The dialogue emphasizes the need for a cultural change in how organizations approach security and compliance, advocating for continuous management and transparency to inspire confidence in security practices. Chapters 00:00 Introduction and Technical Challenges 02:02 Exploring Compliance and Frameworks 05:06 Understanding S-bombs, H-bombs, and F-bombs 10:10 The Importance of Inventory and Asset Management 15:01 Navigating Hardware and Software Lifecycle 19:58 Standards and Regulations in Technology 23:56 The Manchurian Microchip and Hardware Backdoors 27:44 Cultural Change in Security Practices 30:47 The Importance of Transparency and SBOMs 36:39 Challenges in Compliance and Risk Management 42:42 The Hidden Risks of Firmware and Hardware Updates