We already produce a "SBOM", which is just an export of our dependencies. Our dependencies are also scanned for open CVE's, which is non-optimal because it's re

We already produce a "SBOM", which is just an export of our dependencies. Our dependencies are also scanned for open CVE's, which is non-optimal because it's retroactive. The strongest forms of security operations we implement proactively are fuzzing and linting (in combination with strongly typed languages and language variants). The article references the SolarWinds attack but then doesn't go on to explain how it occurred nor how their SBOM would've defeated it. Instead it quotes Microsoft in saying that it was highly sophisticated. Just a reminder that the origins of the SolarWinds Orion hack are still up in the air [0], which makes the definitive tone of this article all the more confusing. It is speculated that hackers compromised TeamCity and that TeamCity injected code during compile time into Orion. This wouldn't be caught by any kind of dependency inspection and doubly so if the attackers were smart enough to use all standard libraries. Like all hacks, this one had signatures too [1]. Some that stand out to me are the network calls: avsvmcloud[.]com deftsecurity[.]com freescanonline[.]com thedoccloud[.]com websitetheme[.]com highdatabase[.]com incomeupdate[.]com databasegalore[.]com panhardware[.]com zupertech[.]com 13.59.205[.]66 54.193.127[.]66 54.215.192[.]52 34.203.203[.]23 139.99.115[.]204 5.252.177[.]25 5.252.177[.]21 204.188.205[.]176 51.89.125[.]18 167.114.213[.]199 It's impossible to hold definitive allow lists for IP addresses or domains, but knowing characteristics about these calls might at least make finding hacks faster, though this logic is also easily defeated. In what I would call a very sterile software environment you might install fully-configured SE Linux on a system, limit your outbound network call destinations to approved locations, run linting with static compilation, fuzzing on your functions and binary inputs. I can still think of a myriad of ways of compromising a distributed system like that. That's not to say, "do nothing" and more to say, this is a very complex problem and something like an "SBOM" isn't new or going to solve this problem if replicated. [0] https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-... [1] https://blog.malwarebytes.com/threat-analysis/2020/12/advanced-cyber-attack-hits-private-and-public-sector-via-supply-chain-software-update/ https://blog.malwarebytes.com/threat-analysis/2020/12/advanc...