3 ms·

I don't quite understand SBoM. How does this help with something like the Solarwinds attack or a general CI compromise? Or is there another type of attack this

by aftbit 3y ago

I don't quite understand SBoM. How does this help with something like the Solarwinds attack or a general CI compromise? Or is there another type of attack this helps mitigate or detect? Their example entry basically just says (very simplified) "Intel both built and supplied the microcode for your Intel CPU". But it says nothing like "Intel used Jenkins version x.y.z which bundled log4j version a.b.c" so you still can't tell if your binary blob was built by a compromised system or not, even once you learn about the potential attack.

bee_rider 3y ago
If nothing else it tells you that Intel is responsible for whatever version of log4j they decided to include in their dependencies.
onei 3y ago
It won't tell you about malware. It just means when my customers have questions about well publicised vulnerabilities in open source dependencies, they can audit themselves for the presence of that dependency with a set of standard tooling. That said, my company is moving towards having SBOMs, but seems to be making them available on request only. Which in my mind defeats the point of having them.
lars_francke 3y ago
The things you mentioned are not solved by a typical "SBOM" but e.g. CycloneDX has extra fields to record provenance and pedigree and things like in-toto (https://in-toto.io/ https://in-toto.io/) or SLSA (https://slsa.dev/ https://slsa.dev/) also aim to work in this field. I've spent the last six months in this field and people will tell you that this or that is an industry best practice or "a standard" but in my experience none of that is true. Everyone is still trying to figure out how best to protect the software supply chain security and things are still very much in flux.
deepsun 3y ago
I always thought SBoMs _can_ link to all the dependencies a build used, which user can later securely resolve to all the transitive binaries/dependencies like log4j version a.b.c.
- tadfisher 3y ago
  In the SolarWinds case, the attack was carried out on the build system itself, so a hypothetical SBoM published by the compromised build system itself would be fairly useless to their customers.
gepeto42 3y ago
I really dislike when people say SBoM could help with the Solarwinds scenario, because it would not. Once the CI/CD environment is compromised, how would the SBoM be trustworthy anyway?

by aftbit 3y ago

bee_rider 3y ago

If nothing else it tells you that Intel is responsible for whatever version of log4j they decided to include in their dependencies.

onei 3y ago

It won't tell you about malware. It just means when my customers have questions about well publicised vulnerabilities in open source dependencies, they can audit themselves for the presence of that dependency with a set of standard tooling. That said, my company is moving towards having SBOMs, but seems to be making them available on request only. Which in my mind defeats the point of having them.

lars_francke 3y ago

The things you mentioned are not solved by a typical "SBOM" but e.g. CycloneDX has extra fields to record provenance and pedigree and things like in-toto (https://in-toto.io/ https://in-toto.io/) or SLSA (https://slsa.dev/ https://slsa.dev/) also aim to work in this field. I've spent the last six months in this field and people will tell you that this or that is an industry best practice or "a standard" but in my experience none of that is true. Everyone is still trying to figure out how best to protect the software supply chain security and things are still very much in flux.

deepsun 3y ago

I always thought SBoMs _can_ link to all the dependencies a build used, which user can later securely resolve to all the transitive binaries/dependencies like log4j version a.b.c.

tadfisher 3y ago
In the SolarWinds case, the attack was carried out on the build system itself, so a hypothetical SBoM published by the compromised build system itself would be fairly useless to their customers.

gepeto42 3y ago

I really dislike when people say SBoM could help with the Solarwinds scenario, because it would not. Once the CI/CD environment is compromised, how would the SBoM be trustworthy anyway?