Security Profile
summary
Adds 12 new externalRefs so SBOM entries point to evidence (assessments, tool outputs, internal reports) and new external identifiers for CVE and GitHub security IDs. Models a triple relationship: vulnerability + product + vulnerable dependency and lets entries be a package, file or snippet. Introduces compact vulnerability objects plus separate assessments (CVSS v2, EPSS, known exploit catalogs) and VEX-style facts to record evolving impact and enable machine-readable distribution via REST APIs instead of ad hoc emails.
AI-written summary · about
chapters (8)
- 0:00Security profile in SPDX
- 1:47External references and evidence
- 3:34Assessments and vulnerability scoring
- 5:21Linking vulnerabilities to artifacts
- 7:28Triple relationship in vulnerability assessment
- 8:11VEX integration for dynamic updates
- 9:14Machine-readable security benefits
- 9:55Feedback and future plans
related talks
44mStructureDefinition 101
31mReverse Engineering Compliance
40mFHIR Profiling: Overview & Introduction
46mIntroduction to Profiling
07mTooling and Sharing Traceability Discussion
14mExploring possibilities for integrating StrictDoc with ELISA's requirements temp...
24mBASIL: Traceability as Code
23mSecurity Considerations in API Docs