Just another talk about SBOM (and VEX)

@SBA Security Meetup 26.11.2024
https://www.meetup.com/de-DE/security-meetup-by-sba-research/events/304127699/

Transcript

1. Just another talk about SBOM (and VEX)
2. What is BOM? 2 Source: https://www.mecalux.com/blog/bill-of-materials-bom
3. What is BOM? 3 Source: https://www.mecalux.com/blog/bill-of-materials-bom
4. What is BOM? 4 Source: https://www.mecalux.com/blog/bill-of-materials-bom
5. What is BOM? - A bill of materials (BOM) is a source of information containing a list of items and instructions to design or manufacture a product. - A bill of materials lists the finished product at the top, followed by individual components and materials. 5 Source: https://www.investopedia.com/terms/b/bill-of-materials.asp
6. What is SBOM? 6 Source: https://tmap.net/node/704
7. What is SBOM? 7 Source: https://tmap.net/node/704
8. What is SBOM? - A Software Bill of Materials (SBOM) is a complete, formally structured list of components, libraries, and modules that are required to build (i.e. compile and link) a given piece of software and the supply chain relationships between them. 8 Source: https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_faq_-_april_15_draft.pdf
9. Why SBOM? - Provides insight into used components and dependencies - Life-cycle management - Effective security management - U.S. EXECUTIVE ORDER 14028 - Formats - SPDX - CycloneDX 9 Sources: https://tmap.net/node/704 https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity
10. Formats - SPDX - CycloneDX - Software Identification Tags - PURL - CPE - SWID (replaces deprecated CPE) 10 Sources: https://scribesecurity.com/de/sbom/standard-formats/#spdx-sbom-standard-format https://www.wiz.io/academy/standard-sbom-formats
11. Formats (SPDX) 11
12. Formats (SPDX) 12
13. Formats (SPDX) 13
14. Formats (CycloneDX) 14
15. Formats (CycloneDX) 15
16. Formats (CycloneDX) 16
17. Tooling 17
18. VEX - Vulnerability Exploitability eXchange - “companion artifact to SBOM” (NTIA) - specifies the “status” of the present vulnerability - formats - OpenVEX - CycloneDX 18 Sources: https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_framing_sharing_july9.pdf https://blog.adolus.com/what-is-vex-and-what-does-it-have-to-do-with-sboms
19. Formats (SARIF) 19
20. Formats (OpenVEX) 20
21. Formats (CycloneDX) 21
22. DEMO
23. Thank You!
24. Next step Source: https://slsa.dev/
25. Q/A - Discussion