All About That BoM, ‘bout That BoM
summary
IBM scales SBOM efforts across 1800+ products and moves from a volunteer army to a dedicated supply chain security org, using SPDX and CycloneDX, IBM Cloud/OpenShift, Tecton, GitHub and OpenSSF tooling. A working group grows to 50+ volunteers; industry data shows only 2% time on security in open source. Key claims: no single tool suffices, many SBOMs fail validation, OEMs won’t supply SBOMs unless contracted, and continuous compliance (daily builds/scans plus ML for vulnerability and legal risk) is required rather than one‑and‑done.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:31Agenda
- 4:28Solarwinds
- 9:37S Bom Working Group
- 13:36Policy and Governance in the Supply Chain Security Pipeline
- 16:21Continuous Compliance
related talks
27mSBOM: The Rest Of the Story
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
26mSBOM today: What is the state of SBOMs?
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
45mSmarter Than Your Average SBOM!
29mMaking Software Bill of Materials (SBOMs) Actionable
57mSBOMs – The Missing Link
22mBuilding a Robust SBOM Solution with Backstage.io