The Opposite of Transparency
summary
Argues that machine-readable SBOM data is the practical fix for opaque software supply chains, showing concrete results: teams with SBOMs plus automated CI/CD remediate external-facing apps in four days and one financial services org fixes 80% of 4,000 apps in four days, while others take weeks or never identify affected devices; vendor patches average 40 days (sometimes 80). Names standards and tools — SPDX, CycloneDX, VEX, KEV, NTIA, NIST, CISA, Executive Order 14028 and the PATCH Act — and shows updating seven packages can eliminate 1,442 CVEs.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 3:55First principles and transparency
- 7:32Bombs in software supply chains
- 8:34Misinformation and disinformation around SBOM
- 15:37History and origin of SBOM
- 22:43What is an SBOM?
- 26:21Industry analysis of Log4j response
- 31:40Smoke screens and risks behind opacity
- 37:02Political will and regulatory changes
- 40:12Five stages of SBOM grief
- 46:11Graduated expectations and procurement
- 49:24Liability and future of software transparency
related talks
27mHow Software Transparency Can Help Save the World
30mTransparency in the Software Supply Chain: Making SBOM a Reality
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
29mMaking Software Bill of Materials (SBOMs) Actionable
22mSBOM and Security Transparency - How it all fits together
44mNavigating Open Source and Open Standards for Better Cybersecurity
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture