SBOM and Security Transparency - How it all fits together
summary
SBOMs become concrete: CISA runs a program, publishes a software identification ecosystem paper and pushes VEX machine-readable assertions and a vul enrichment scheme to add identifiers and CWEs to CVE records. Regulators (US EO, EU Cyber Resilience, Japan v2 guidance) force adoption for medical devices and vehicles. Work in progress includes omniore and Software Heritage IDs for identity, a plugfest showing tools produce differing SBOMs, and practical gaps for proprietary tooling and end‑of‑life data.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:09What is an SBOM
- 3:18Supply chain risks
- 6:32Regulatory landscape
- 7:56SBOM data quality challenges
- 9:26Software identity complexity
- 11:17Vulnerability disclosure process
- 13:45Improving vulnerability records
- 15:08VEX for prioritization
- 16:53Future of SBOM
- 18:17SBOM automation
- 20:26SBOM standards harmonization
related talks
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
27mSBOM: The Rest Of the Story
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
30mTransparency in the Software Supply Chain: Making SBOM a Reality
26mSBOM today: What is the state of SBOMs?
45mSmarter Than Your Average SBOM!
52mThe World on SBOMs