Is CBOM Enough?
summary
CBOM is a CycloneDX extension standardized six months ago (CycloneDX v1.6) that encodes algorithms, keys, certificates and protocol references as machine-readable JSON, and promises inventory visibility; adoption follows SBOM’s multi-year curve (Linux Foundation 2022 showed ~3 years). Practical gaps appear: CBOM is static, requires merging multiple CBOMs, telemetry and consolidation logic, and does not provide key management. Operational fixes include real-time collectors, historical queries and a central crypto proxy or hub plus telemetry like open elry to make CBOMs actionable.
AI-written summary · about
chapters (13)
- 0:00Introduction and welcome
- 0:35Speaker introduction
- 2:00The urgency of PQC transition
- 3:15Introduction to CBOM
- 7:31SBOM vs CBOM
- 12:38CBOM structure and examples
- 13:49Extensibility in CBOM
- 18:32Building cryptographic inventory
- 19:06Inventory management
- 22:10Monitoring and limitations
- 22:40Recommendations for success
- 23:42Conclusion
- 24:29Q&A session
related talks
32mCryptographic Governance: Software Supply Chain Security With CBOM
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
50mSBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX
29mThe Current State of SBOMs for End Users
27mSBOM: The Rest Of the Story
26mSBOM today: What is the state of SBOMs?
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
45mSmarter Than Your Average SBOM!