Cryptographic Governance: Software Supply Chain Security With CBOM
summary
A cryptographic SBOM component is now part of CycloneDX 1.6, capturing metadata (not key values) for algorithms, certificates and protocols so teams can auto-check policies with CEL/OPA rules and flag uses like MD5. A SonarQube plugin and CycloneDX generators produce C‑BOMs from source, dependency databases and container scans, letting operations extract inventories from images and map crypto to data — useful for quantum‑safe migration — though static analysis and coverage gaps mean confidence is still partial despite tool integrations and a proposed Linux Foundation database.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:48Cryptographic Governance
- 2:17Regulation and Policies
- 4:07What We Miss
- 5:28CBOM
- 6:44Crypto Properties
- 9:21Crypto Inventory
- 10:45Data Usage
- 12:33Software Supply Security
- 19:50Automated Compliance Check
- 22:54Using CBOM
- 25:34Questions
related talks
30mIs CBOM Enough?
29mCommit-Then-Disclose: Cryptographic SBOM Auditing Without IP Leakage
50mSBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
34mTransforming SBOMs from Compliance Burden to Security Asset
26mFlagship Projects: CycloneDX
35mTransforming SBOMs from Compliance Burden to Security Asset
27mSBOM: The Rest Of the Story