Transparency in the Software Supply Chain: Making SBOM a Reality
summary
NTIA convenes a multistakeholder initiative to make SBOMs routine, with four working groups producing drafts by Sept 5, 2019; two usable formats are SPDX and SWID; a medical-device pilot with Siemens, Abbott, Philips and Mayo Clinic delivers SBOM data that completes security and procurement use cases but not yet fully automatically (medical-device pilot); practical obstacles are naming, depth of dependency graphs, and prioritizing vulnerability vs exploitability; commercial pressure already exists — one bank demands SBOMs or a 5–10% contract discount.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:46Welcome
- 1:30Who knows this logo
- 2:34How business works
- 3:55Why not for software
- 4:43Benefits for each perspective
- 5:44The fundamental question
- 6:19Licensing is fraught
- 6:59Its hard
- 7:49DNS
- 8:33NTIA
- 9:19What we are not doing
- 9:55Problem Statement
- 10:18Goal
- 10:45Progress
- 11:18What is NS
- 12:08Relationships
- 12:32Recursive approach
- 14:38SBOM Standards
- 15:54SBOM XML
- 16:23Medical Device Industry
- 18:15Obstacles to Transparency
- 18:54What is Transparency
- 19:40Vulnerability vs Exploitability
- 20:25Next Steps
- 22:23Questions
related talks
27mHow Software Transparency Can Help Save the World
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
22mSBOM and Security Transparency - How it all fits together
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
26mSBOM Open Questions
16mSBOM, the Beginning of Transparency
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security