Securing Open Source With SBOM: From Visibility To Trust
summary
Claims an automated SBOM and vulnerability pipeline built as IoTcube.net (web UI plus back end called headbomb) that uses code‑level analysis algorithms Centric, Synapse, Body to detect modified components, dependency graphs and hidden flaws. Demonstrates detection of 90%+ modified components, cases like MongoDB containing 36 embedded libraries, JavaScript packages pulling ~683 transitive deps, and finds 2% mislabeled CVEs after evaluating >5,000 CVEs (96 problematic entries); integrates SBOM/VEX concepts and aims to interoperate with OpenSSF Guac and OpenVEX.
AI-written summary · about
chapters (15)
- 0:00Open source security challenges
- 2:33Open source vulnerability management
- 3:37Vulnerability tracking challenges
- 5:02Modified components challenge
- 6:27Dependency explosion challenge
- 7:34Duplicate components challenge
- 8:19Name mismatches challenge
- 10:02CVE mapping impact
- 12:12Visibility with SBOM and VEX
- 14:01IoT Cube for analysis
- 16:31HeadBOM detection algorithms
- 17:37Demo: HeadBOM analysis
- 19:24SBOM to VEX conversion
- 20:07Future plans for security
- 21:12Q&A
related talks
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
29mMaking Software Bill of Materials (SBOMs) Actionable
01h 16mCybersecurity with CDF & OpenSSF Focus Group
56mFrom SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
23mSupply Chain Security using Free and Open Tools
43mA radiography of a SBOM vulnerability scanner