Importance of Software Bill of Materials (SBOMs) to help understand your security risk

No ratings

Presented at SaintCon 2024 by

Andrew Hall

Software is very complex and the development of SBOMs has allowed ways to understand the true risk of software through matching libraries to vulnerabilities. I will go through the types of SBOMs and explain the two formats in use today and the difficulties of generation of SBOM in different stages of the software development cycle. Using these SBOMs will then go into how you generate a Vulnerablity EXchange (VEX) file from the SBOM to see the CVE and other vulnerabilities in the example package or image. I will demo a set of free tools available to generate SBOM and VEX files. Talk how you can use this information to track software issues that come up like log4j.