The World on SBOMs
summary
SBOMs become actionable: the NTIA minimum elements are the baseline, a working group defines six SBOM types (design, source, build, product, deployed, runtime) and traces must link build → deployed → runtime. Tooling exists: the Zephyr project produces three SBOMs per build with hashed source-file traceability, and New York Presbyterian open‑sourced DaggerBoard for ingesting SBOMs and matching vulnerabilities. Practical rules: ship an SBOM with every binary, contract SBOM delivery, and link SBOMs to avoid false positives.
AI-written summary · about
chapters (11)
- 0:00Intro
- 2:46Critical Infrastructure Today: Mix Open & Proprietary
- 5:20Minimum SBOM Elements
- 12:50Understanding System: Traceability
- 14:11Electric Sector Supply Chain Stakeholders
- 17:20Supply chain intelligence supports the grid
- 18:13Supply Chain Intelligence Supports Functions
- 23:16Integrator Delivering Solution
- 25:02Utility Operations Installing a New Product
- 37:16Understanding Safety Critical System: Traceability
- 45:21Utility managing a security fix
related talks
27mSBOM: The Rest Of the Story
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
45mSmarter Than Your Average SBOM!
26mSBOM today: What is the state of SBOMs?
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help