Making Software Bill of Materials (SBOMs) Actionable
summary
Claims that SBOMs become actionable by generating and attaching them to OCI images, signing and verifying them, scanning for CVEs, and quarantining artifacts when severity exceeds a threshold. Demonstrated workflow uses syft and grype to create and analyze an SPDX/CycloneDX SBOM, cosign + OCI layer to sign and attach, and Cloudsmith quarantine to block deployment. Notes that over 80% of software uses open source, vulnerabilities are the initial access in ~31% of incidents, and under 10% are actually exploitable, so prioritization is key.
AI-written summary · about
chapters (10)
- 0:00Introduction to SBOMs
- 2:43Software supply chain
- 4:28Open source threats
- 8:24Government SBOM mandates
- 9:47What is an SBOM
- 11:10Generating SBOMs in lifecycle
- 14:21Hosting SBOMs effectively
- 15:44Vulnerability management with SBOMs
- 19:38Demo: container images
- 27:29Future of SBOM tooling
related talks
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
25mA Primer on Software Bill of Materials for DevSecOps
36mSBOMs, VEX, and Kubernetes
35mTransforming SBOMs from Compliance Burden to Security Asset
45mSmarter Than Your Average SBOM!
27mSBOM: The Rest Of the Story