SBOMs represent a major advance in software supply chain security, offering unprecedented transparency and control over software components.
For procurement and supply chain professionals, understanding and implementing SBOMs is not just about compliance; it's about proactively safeguarding the integrity and security of software assets. Embracing SBOMs means staying ahead in a world where software vulnerabilities can have far-reaching impacts on organizational security and resilience.
Despite the emergence of the Software Bill of Materials (SBOMs) as a shift in how to approach software security, many organizations still need guidance for using it effectively.
A new document from the Enduring Security Framework (ESF) — a collaborative partnership among industry, academia, and government — offers a deep dive on SBOMs, and details best practices that can help procurement and supply chain professionals navigate ways to ensure software security in the supply chain. Specifically, the report emphasizes the importance of SBOMs for open-source software, which is often used in commercial products and can introduce vulnerabilities if not properly managed.
Video excerpt: Learn how SBOMs make suppliers more trustworthy.
See more in the full on-demand webinar: Building a Trusted Software Supply Chain.
5 Key Takeaways
Here are major themes that are prominent in the ESF guidance:
Enhanced vulnerability management with SBOMs: SBOMs facilitate quick identification of vulnerable software components, crucial in an era where attackers exploit vulnerabilities rapidly after disclosure. Automated SBOM generation and integration with software security tools are vital for efficient vulnerability analysis and management.
The role of SBOMs in software delivery: SBOMs play a critical role in verifying software package contents, including detecting potential vulnerabilities and software of unknown provenance (SOUP). Before releasing software to customers, developers and suppliers should perform binary composition analysis and validate the build process, using SBOMs to document the actual contents of the delivered package.
Compliance with executive orders and industry standards: Executive Order 14028 emphasizes the need for SBOMs in enhancing software security. It mandates suppliers to provide SBOMs to purchasers or publish them publicly. SBOMs must comply with minimum elements set by the Department of Commerce and NTIA, aligning with standards such as SPDX and CycloneDX.
SBOM generation and validation tools: A range of tools are available for generating and validating SBOMs, to help ensure they meet industry standards and regulatory requirements. Continuous SBOM validation is recommended for maintaining software security throughout the development lifecycle.
Supplier responsibilities in SBOM management: Suppliers must define policies and validate product integrity using SBOMs. This includes not only the software package itself but also third-party software information. Continuous scanning for vulnerabilities and regular SBOM updates are both essential to ensure ongoing compliance and security.
Managing the Risks Responsibly
“All organizations, whether they are a single developer or a large industry company, have an ongoing responsibility to maintain software supply chain security practices in order to mitigate risks,” the ESF guidance states. The report also emphasizes the importance of regular monitoring of open-source software components for vulnerabilities and security updates.
A good playbook for risk management needs a proactive posture supported by the right tools and insights. A platform like 1Exiger can couple extensive supplier network insights with software analysis prowess so that you’re not just reacting to emerging threats.
The guidance highlights an important practice about adoption of open source: “software should first be evaluated using precursory analysis.” A key component of the 1Exiger platform, Ion Channel, helps tame the complexity of software supply chain risk management by providing leading indicators of risk, identifying transitive dependencies, and layering on supply chain intelligence, right down to the product level, for unparalleled insights.
