How Software Transparency Can Help Save the World
summary
Claim: a machine-readable SBOM lets organizations answer “Am I affected?” by mapping actual components and versions, hashes and relationships. Work focuses on reconciling SPDX and SWID and CycloneDX formats, building tooling and a multi-stakeholder ecosystem. A healthcare proof-of-concept with FDA-mandated device SBOMs shows hospitals can do asset management, vulnerability triage and pre-purchase risk decisions, but full automation is not yet achieved. Typical large OS trees measure on the order of ~10,000 components deep.
AI-written summary · about
chapters (17)
- 0:00Introduction by host
- 0:44Why software transparency matters
- 2:10Transparency as risk management
- 3:37Industry parallels for transparency
- 5:24Software supply chain risks
- 7:56Legal and market challenges
- 9:43Government’s role in transparency
- 11:28Progress and next steps
- 12:09What is a Software Bill of Materials
- 15:01Systemic benefits of SBOMs
- 17:29Standards for SBOM data
- 18:56Regulatory momentum in healthcare
- 20:02Tooling and adoption challenges
- 20:44Naming and data sharing hurdles
- 21:50Vulnerability exploitability context
- 22:32Transparency as security foundation
- 23:16Q&A: Scope of SBOMs
related talks
30mTransparency in the Software Supply Chain: Making SBOM a Reality
51mThe Opposite of Transparency
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
15mFrom SBOM to Dependency Stacks: Making Software Structure Visible