The Struggle for Software Supply Chain Security: Mandates vs. Actual Protection

Software Bills of Materials (SBOMs): A Growing Trend in Software Development

Software bills of materials (SBOMs) have gained significant attention and traction in recent months, following an executive order from the Biden administration that requires federal contractors to provide SBOMs. SBOMs outline the components and dependencies used in the development of applications, giving organizations better visibility into the software they use. As a result, the demand for SBOMs has increased not only in the government sector but also in the private sector, with a projected 60% of companies expected to require SBOMs by 2025, up from less than 5% in 2022, according to market research firm Gartner.

The Importance of SBOMs

The adoption of SBOMs is driven by the need for organizations to manage the risks associated with software development, particularly in the realm of open source software. Stephen Magill, Vice President of Product Innovation at Sonatype, a software development tools firm, emphasizes the importance of SBOMs in addressing the risks posed by open source software, which is often unmanaged in many organizations. SBOMs serve as an incentive to improve development processes and implement the necessary tooling to effectively manage software components and dependencies.

Standards for SBOMs

The US government recognizes three SBOM standards that meet the minimum requirements: Software Identification (SWID) tags, Software Package Data Exchange (SPDX), and CycloneDX. SWID tags were created by the International Standards Organization (ISO) in 2009 to track software installed on managed systems. SPDX, created by the Linux Foundation, focuses on information exchange about licensing. CycloneDX, introduced by the Open Web Application Security Project (OWASP), aims to exchange data on SBOMs.

While all three standards overlap, SPDX and CycloneDX have gained more momentum. SPDX has a greater emphasis on license management and machine readability, while CycloneDX provides more comprehensive information, including machine learning models used in applications. Despite the nuances between the standards, both developers and security teams can work with the formats to enhance security decision-making, track dependencies, and prioritize remediation actions.

The Evolution of SBOMs

Initially, SBOMs primarily focused on raising awareness and visibility of software components and dependencies. CycloneDX SBOMs, for example, provide information on software licenses, low-code services, machine learning models, vulnerability disclosure, and annotations. This improved visibility helps organizations make informed decisions regarding risk management and software inventory. However, the ultimate goal is to operationalize SBOMs, allowing for more advanced risk measures and potential security controls to be linked to SBOMs, potentially leading to software liability frameworks.

Machine Learning and Automation in SBOMs

SBOMs play a crucial role in automating vulnerability response and tracking software vulnerabilities. In the wake of the Log4j vulnerabilities exploited by the Log4Shell proof-of-concept, organizations with SBOMs were better equipped to determine if they were vulnerable to the attack. SBOMs enable organizations to identify vulnerabilities in their products, especially those stemming from indirect dependencies, and implement controls and compensating measures to mitigate the risk. Without SBOMs, organizations would be blind to these risks and rely solely on the assumption of secure device development by manufacturers.

Editorial: The Importance of SBOMs for Software Security

The increasing adoption of SBOMs reflects the pressing need for better software security and supply chain management. The rise of open source software and the complex web of dependencies inherent in modern software development have underscored the need for organizations to have comprehensive visibility into their software components.

SBOMs provide a holistic view of software ingredients, enabling organizations to identify and address potential vulnerabilities and risks. By documenting the components used in software development, organizations can make informed decisions and prioritize remediation efforts, ensuring that critical vulnerabilities are addressed promptly.

Furthermore, the automation and machine readability of SBOMs enhance the efficiency and effectiveness of vulnerability management. Quick identification of software components affected by newly discovered vulnerabilities enables organizations to respond swiftly and implement appropriate security controls and mitigations. This proactive approach in vulnerability management reduces the window of opportunity for attackers, protecting organizations and their stakeholders from potential threats.

While the current focus of SBOMs is primarily on awareness and visibility, the future holds great potential for the operationalization of SBOMs. Linking risk measures and security controls to SBOMs, along with the establishment of software liability frameworks, can provide organizations with a structured approach to software security and accountability.

Advice for Organizations: Embracing SBOMs for Enhanced Software Security

As the demand for SBOMs continues to grow, organizations need to embrace this practice to strengthen their software security posture. Here are some key considerations:

Implement SBOM Documentation:

Organizations should adopt tools and processes that allow for the generation and maintenance of SBOMs. This includes using software development tools that support SBOM formats such as SPDX and CycloneDX. By integrating SBOM documentation into the development lifecycle, organizations can easily track software components and dependencies, enabling better decision-making and risk management.

Collaborate with Software Vendors:

Collaboration with software vendors is crucial for obtaining accurate and up-to-date SBOMs. Organizations should include SBOM requirements in their procurement process and work closely with vendors to ensure the availability of comprehensive and accurate SBOMs. This collaboration fosters transparency and helps organizations make informed decisions about the software they procure.

Leverage Automation and Machine Learning:

Organizations should explore the integration of automation and machine learning capabilities in their SBOM practices. Automating the generation and analysis of SBOMs can significantly improve efficiency and accuracy. Machine learning algorithms can assist in assessing vulnerability risks and prioritizing remediation efforts, enhancing overall software security.

Stay Informed and Engage in Standardization Efforts:

The landscape of SBOM standards is evolving, and organizations should stay informed about the latest developments and industry best practices. Engaging in standardization efforts, such as contributing to the development of SBOM standards or participating in relevant industry forums, allows organizations to shape the future of software security and ensure their specific needs are addressed.

In conclusion, SBOMs are becoming an essential tool for organizations seeking to improve their software security and supply chain management. By embracing SBOMs, organizations can enhance visibility, mitigate risks, and strengthen their overall security posture in the face of evolving threats and vulnerabilities.