Difference between revisions of "SBOM"

From MgmtWiki
Jump to: navigation, search
(SBOM Formats and Standards)
(SBOM Formats and Standards)
Line 17: Line 17:
# Software ID tags - [https://csrc.nist.gov/projects/Software-Identification-SWID SWID tag]
# Software ID tags - [https://csrc.nist.gov/projects/Software-Identification-SWID SWID tag]
# Software Heritage persistent ID - [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html SWHID]
# Software Heritage persistent ID - [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html SWHID]
* [https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_formats_energy_brief_2021.pdf NTIA SBOM: Formats and Tooling] PDF slide show

Revision as of 18:55, 27 May 2022

Full Title

“Software Bill of Materials” or SBOM means a formal record containing the details and supply chain relationships of various components used in building software


  • While the term SBOM is not new, it received limited attention until the publication of the Executive Order on Cybersecurity on 2021-05-12.
  • Software developers and vendors often create products by assembling existing open source and commercial software components. The SBOM enumerates these components in a product. It is analogous to a list of ingredients on food packaging. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability. A widely used, machine-readable SBOM format allows for greater benefits through automation and tool integration. The SBOMs gain greater value when collectively stored in a repository that can be easily queried by other applications and systems. Understanding the supply chain of software, obtaining an SBOM, and using it to analyze known vulnerabilities are crucial in managing risk.
  • SBOM FAQ 2020-11-16

SBOM Formats and Standards

  1. Software Package Data Exchange (SPDX), an open-source machine-readable format with origins in Linux Foundation and recently approved as ISO/IEC standard.
  2. CycloneDX (CDX), an open-source machine-readable format with origins in the OWASP community
  3. Software Identification (SWID) an ISO/IEC industry standard used by various commercial software publishers
  • Identify Software Identifiers in Commercial Use and Emerging Identifiers
  1. Common Package Enumeration - CPE
  2. Package URLs - PURL
  3. Software ID tags - SWID tag
  4. Software Heritage persistent ID - SWHID


It is not clear who will be responsible for defining a SBOM. Here is one current problem in 2021. There is a open source product did:orb that includes a make file that depends on GCC (the Gnu Compiler). Now the problem is that there is no way to build the code without these tools. I am unclear how it could be possible to know if the tools provided any contribution the the finished products if it is required to build the product. So, is the GCC part of the did:orb SBOM? The following wiki page contains a sample SBOM, Did:orb#Software_Bill_of_Materials.

  • SBOM critique 2022-02-22 CSO Online - Software bills of material are having a moment, but the costs of an externally visible SBOM are likely to outweigh the benefits, says Andy Ellis.