Smarter Than Your Average SBOM!
Talkat ContainerCon @ OSS EU 2023 · on Tuesday, 2023-09-19· at 16:35· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
SBOMs are useful point-in-time snapshots but only if created at build time, cryptographically signed, and validated on consumption; examples use CycloneDX as the format, Snyk and OpenSSF scorecards for quality, and the parlay tool to enrich SBOMs with license, supplier and vulnerability data. The talk argues for CI/CD gating via policy engines (Open Policy Agent), embedding OpenVEX/VEX or VDR for exploitability, and rebuilding/verifying provenance (SLSA-style controls) to avoid forged or incomplete SBOMs.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:06What is an SBOM
- 3:11Why SBOMs matter
- 6:22Trust in SBOMs
- 8:10SBOM formats and testing
- 11:40Enriching SBOMs
- 15:51Managing vulnerabilities
- 17:35VEX and VDR
- 20:01SBOM integrity threats
- 27:19SBOM threats and lifecycle
- 30:07SALSA framework
- 32:12SBOMs in trust systems
- 33:58Q&A: Transferring SBOMs
- 41:54Q&A: Transitive dependencies
- 42:15Q&A: Trust in enriched SBOMs
related talks
45mSmarter Than Your Average SBOM!
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
46mSBOMs Are Not Enough
52mThe World on SBOMs
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
41mYour SBOM Is Lying To You – Let’s Make It Honest