Difference between revisions of "SBOM"
From MgmtWiki
(→Solutions) |
(→Solutions) |
||
| Line 25: | Line 25: | ||
==Solutions== | ==Solutions== | ||
* [https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-salus-software-bill-of-materials-sbom-generation-tool/ Microsoft open sources Salus software bill of materials (SBOM) generation tool] 2022-06-12 | * [https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-salus-software-bill-of-materials-sbom-generation-tool/ Microsoft open sources Salus software bill of materials (SBOM) generation tool] 2022-06-12 | ||
| − | * [https://blackberry.qnx.com/en/products/security/blackberry-jarvis BlackBerry Jarvis 2.0] Software Composition Analysis and Security Testing for Embedded Systems<blockquote>A software bill of materials (SBOM) can help you identify critical information about software components, allowing you to detect potential issues with implications for intellectual property disputes, security risks or overall quality. BlackBerry Jarvis 2.0 provides a view of your product’s SBOM without depending on what your suppliers provide. It provides you with vendor and product details for each file via an interactive chart.</blockquote> | + | * [https://blackberry.qnx.com/en/products/security/blackberry-jarvis BlackBerry Jarvis 2.0] Software Composition Analysis and Security Testing for Embedded Systems<blockquote>A software bill of materials (SBOM) can help you identify critical information about software components, allowing you to detect potential issues with implications for intellectual property disputes, security risks or overall quality. BlackBerry Jarvis 2.0 provides a view of your product’s SBOM without depending on what your suppliers provide. It provides you with vendor and product details for each file via an interactive chart. BlackBerry Jarvis 2.0 helps you identify risks with multiple dashboards including those for Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE). It excels in accurately detecting vulnerabilities thanks to its ability to derive deep insights on many aspects of the security of a binary package. </blockquote> |
==References== | ==References== | ||
Revision as of 22:25, 3 August 2022
Full Title
“Software Bill of Materials” or SBOM means a formal record containing the details and supply chain relationships of various components used in building software
Context
- While the term SBOM is not new, it received limited attention until the publication of the Executive Order on Cybersecurity on 2021-05-12.
- Software developers and vendors often create products by assembling existing open source and commercial software components. The SBOM enumerates these components in a product. It is analogous to a list of ingredients on food packaging. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability. A widely used, machine-readable SBOM format allows for greater benefits through automation and tool integration. The SBOMs gain greater value when collectively stored in a repository that can be easily queried by other applications and systems. Understanding the supply chain of software, obtaining an SBOM, and using it to analyze known vulnerabilities are crucial in managing risk.
- SBOM FAQ 2020-11-16
SBOM Formats and Standards
- The NTIA Software Transparency Working Group on Standards and Formats was formed at the outset of the NTIA initiative in 2018 to assess available current formats for software bills of materials as well as forward-looking use-cases identified by other working groups or communities of practice identified three formats in widespread use:
- Software Package Data Exchange (SPDX), an open-source machine-readable format with origins in Linux Foundation and recently approved as ISO/IEC standard.
- CycloneDX (CDX), an open-source machine-readable format with origins in the OWASP community
- Software Identification (SWID) an ISO/IEC industry standard used by various commercial software publishers
- Identify Software Identifiers in Commercial Use and Emerging Identifiers
- Common Package Enumeration - CPE
- Package URLs - PURL
- Software ID tags - SWID tag
- Software Heritage persistent ID - SWHID
- NTIA SBOM: Formats and Tooling PDF slide show
Problems
It is not clear who will be responsible for defining a SBOM. Here is one current problem in 2021. There is a open source product did:orb that includes a make file that depends on GCC (the Gnu Compiler). Now the problem is that there is no way to build the code without these tools. I am unclear how it could be possible to know if the tools provided any contribution the the finished products if it is required to build the product. So, is the GCC part of the did:orb SBOM? The following wiki page contains a sample SBOM, Did:orb#Software_Bill_of_Materials.
- SBOM critique 2022-02-22 CSO Online - Software bills of material are having a moment, but the costs of an externally visible SBOM are likely to outweigh the benefits, says Andy Ellis.
Solutions
- Microsoft open sources Salus software bill of materials (SBOM) generation tool 2022-06-12
- BlackBerry Jarvis 2.0 Software Composition Analysis and Security Testing for Embedded Systems
A software bill of materials (SBOM) can help you identify critical information about software components, allowing you to detect potential issues with implications for intellectual property disputes, security risks or overall quality. BlackBerry Jarvis 2.0 provides a view of your product’s SBOM without depending on what your suppliers provide. It provides you with vendor and product details for each file via an interactive chart. BlackBerry Jarvis 2.0 helps you identify risks with multiple dashboards including those for Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE). It excels in accurately detecting vulnerabilities thanks to its ability to derive deep insights on many aspects of the security of a binary package.
