4 ms·
SBOMs are a solution intended to help solve a couple of problems: 1) help identify and remediate software that has been built with vulnerable packages (think l
by Khaine 10mo ago
SBOMs are a solution intended to help solve a couple of problems:
1) help identify and remediate software that has been built with vulnerable packages (think log4j).
2) help protect against supply chain compromise as the SBOM contains hashes that allow packages to be verified
- ozim 10mo agoYou forgot about the important one SBOMs are created with thought about sharing them with third parties like your customers - lock files not.
- Khaine 10mo agoThats an important point. You can't tell if the software you use is vulnerable to something like log4j without the vendor telling you, or doing lots of manual investigation. SBOMs are supposed to help with software composition analysis. Basically, you as an enterprise have an inventory of what software you use, and their SBOMs (i.e. dependencies). I can then use this to automatically check which software is impacted by severe vulnerabilities when they are announced.
- pacificpendant 10mo agohttps://www.ntia.gov/sites/default/files/publications/sbom_minimum_elements_report_0.pdf https://www.ntia.gov/sites/default/files/publications/sbom_m... Depending on who you ask an SBOM might not need a hash. NTIA only recommend a hash.