6 citations · 9 across the 13 of their papers we have counts for
13 papers
VeriPort: Automated and Verified Patch Backporting at Scale
Jonah Ghebremichael, Wenxin Jiang, Mikola Lysenko +3
One of the key challenges for securing the software supply chain is addressing known vulnerabilities in third-party open-source dependencies. Security patches are frequently only a…
S3C2 Summit 2025-09: Industry Secure Supply Chain Summit
Md Atiqur Rahman, Yasemin Acar, Michel Cucker +5
Today's digital ecosystem relies heavily on software supply chains, which enable developers to reuse code and ship software at scale. However, a single vulnerable component can jeo…
S3C2 Summit 2025-07: Government Secure Supply Chain Summit
Sivana Hamer, Pat Morrison, William Enck +6
Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an ex…
WAAA! Web Adversaries Against Agentic Browsers
Sohom Datta, Alex Nahapetyan, William Enck +1
Large language models (LLMs) are increasingly being integrated into web browsers to create agentic browsing systems that execute actions on behalf of the user. Prior work consideri…
Multi-Agent Taint Specification Extraction for Vulnerability Detection
Jonah Ghebremichael, Saastha Vasan, Saad Ullah +6
Static Application Security Testing (SAST) tools using taint analysis are widely viewed as providing higher-quality vulnerability detection results compared to traditional pattern-…
S3C2 SICP Summit 2025-06: Vulnerability Response Summit
Anna Lena Rotthaler, Simon Oberthür, Juraj Somorovsky +9
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US a…
S3C2 Summit 2025-03: Industry Secure Supply Chain Summit
Elizabeth Lin, Jonah Ghebremichael, William Enck +5
Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an ex…
Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?
Imranur Rahman, Jill Marley, William Enck +1
Developers consistently use version constraints to specify acceptable versions of the dependencies for their project. Pinning dependencies can reduce the likelihood of breaking cha…
S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit
Imranur Rahman, Yasemin Acar, Michel Cukier +5
While providing economic and software development value, software supply chains are only as strong as their weakest link. Over the past several years, there has been an exponential…
S3C2 Summit 2024-08: Government Secure Supply Chain Summit
Courtney Miller, William Enck, Yasemin Acar +5
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their sup…
S3C2 Summit 2023-11: Industry Secure Supply Chain Summit
Nusrat Zahan, Yasemin Acar, Michel Cukier +5
Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing atten…
S3C2 Summit 2024-03: Industry Secure Supply Chain Summit
Greg Tystahl, Yasemin Acar, Michel Cukier +5
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their sup…
How Quickly Do Development Teams Update Their Vulnerable Dependencies?
Imranur Rahman, Ranindya Paramitha, Nusrat Zahan +2
Industry practitioners are increasingly concerned with software that contains vulnerable versions of third-party dependencies that are included both directly and transitively. To a…