SBOMs: Navigating the Evolving Landscape of Software Bill of Materials
summary
SBOMs move from optional to legally required in the US and EU (US executive order May 2021, FDA medical device rule 2022) so vendors must produce machine-readable inventories of ingredients, vulnerabilities and lifecycle data. Practical toolchain examples: CycloneDX, SPDX, SWID for SBOMs, VEX / OpenVEX and Sigstore for vulnerability exchange and signing, plus CDXGen, in-toto, SLSA and dependency‑track for attestation and graphing. Claim: 40% of attacks come via supply chain, so high‑fidelity inventories speed response, enable OPA-style policy-as-code, and reduce GRC churn (one org sees 20 new repos, five products in weeks).
AI-written summary · about
chapters (12)
- 0:00SBOMs introduction
- 3:16Supply chain transparency
- 7:35SBOM standards and laws
- 11:20Global SBOM regulations
- 16:25SBOM component standards
- 19:43GRC and security benefits
- 21:52SBOM tools
- 27:22SBOMs vs vulnerability management
- 28:07Policy automation with SBOMs
- 30:18SBOM transparency risks
- 31:53SBOM accuracy challenges
- 33:19SBOM generation insights
related talks
27mSBOM: The Rest Of the Story
16mSBOM, the Beginning of Transparency
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
30mTransparency in the Software Supply Chain: Making SBOM a Reality
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
22mSBOM and Security Transparency - How it all fits together
29mMaking Software Bill of Materials (SBOMs) Actionable