Difference between revisions of "SBOM"

Revision as of 18:55, 27 May 2022

Full Title

“Software Bill of Materials” or SBOM means a formal record containing the details and supply chain relationships of various components used in building software

Context

• While the term SBOM is not new, it received limited attention until the publication of the Executive Order on Cybersecurity on 2021-05-12.
• Software developers and vendors often create products by assembling existing open source and commercial software components. The SBOM enumerates these components in a product. It is analogous to a list of ingredients on food packaging. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability. A widely used, machine-readable SBOM format allows for greater benefits through automation and tool integration. The SBOMs gain greater value when collectively stored in a repository that can be easily queried by other applications and systems. Understanding the supply chain of software, obtaining an SBOM, and using it to analyze known vulnerabilities are crucial in managing risk.
• SBOM FAQ 2020-11-16

SBOM Formats and Standards

• The NTIA Software Transparency Working Group on Standards and Formats was formed at the outset of the NTIA initiative in 2018 to assess available current formats for software bills of materials as well as forward-looking use-cases identified by other working groups or communities of practice identified three formats in widespread use:

1. Software Package Data Exchange (SPDX), an open-source machine-readable format with origins in Linux Foundation and recently approved as ISO/IEC standard.
2. CycloneDX (CDX), an open-source machine-readable format with origins in the OWASP community
3. Software Identification (SWID) an ISO/IEC industry standard used by various commercial software publishers

• Identify Software Identifiers in Commercial Use and Emerging Identifiers

1. Common Package Enumeration - CPE
2. Package URLs - PURL
3. Software ID tags - SWID tag
4. Software Heritage persistent ID - SWHID

• NTIA SBOM: Formats and Tooling PDF slide show

Problems

It is not clear who will be responsible for defining a SBOM. Here is one current problem in 2021. There is a open source product did:orb that includes a make file that depends on GCC (the Gnu Compiler). Now the problem is that there is no way to build the code without these tools. I am unclear how it could be possible to know if the tools provided any contribution the the finished products if it is required to build the product. So, is the GCC part of the did:orb SBOM? The following wiki page contains a sample SBOM, Did:orb#Software_Bill_of_Materials.

• SBOM critique 2022-02-22 CSO Online - Software bills of material are having a moment, but the costs of an externally visible SBOM are likely to outweigh the benefits, says Andy Ellis.

Solutions

References