ForAllSecure’s Dynamic Software Bill of Materials: Revolutionizing Application Security

ForAllSecure Introduces Dynamic Software Bill of Materials (SBOM) Solution for Improved Application Security

Pittsburgh, Oct. 4, 2023 – ForAllSecure, a leading application security testing company, has unveiled its new runtime dynamic Software Bill of Materials (SBOM) solution for its Mayhem Security product. This innovative tool aims to assist organizations in identifying, prioritizing, and addressing vulnerabilities present in open source and third-party software components, ultimately saving valuable time and resources.

Ensuring Software Supply Chain Security

In today’s security threat landscape, managing software supply chain risks has become crucial. Open source software (OSS) offers developers the advantage of accessing and modifying prewritten source code, drastically saving development time. However, attackers can exploit vulnerabilities within open-source software for supply chain attacks, as demonstrated by recent incidents like SolarWinds and Keysa.

Recognizing the importance of effectively addressing these risks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends that all software provide an inventory of open-source components and other code dependencies. This inventory, commonly known as a Software Bill of Materials, allows organizations to understand the software being used in their assets and gain confidence in a manufacturer’s software development practices.

The Limitations of Traditional SBOMs

While traditional SBOMs provide a passive list of included components, they do not offer real-time intelligence on which components are present during runtime. This lack of context hinders developers in assessing and prioritizing potential security issues. Recognizing this gap, ForAllSecure‘s Mayhem Security product integrates a dynamic SBOM generation feature, providing developers with valuable insights into the attack surface of their applications.

A Comprehensive Solution for Developers

Mayhem Security’s dynamic SBOM functionality enables developers to quickly understand which components are present at runtime and prioritize remediation efforts based on risk. By eliminating unnecessary noise and overhead associated with traditional application security testing tools, Mayhem Security allows developers to focus their attention on addressing actual security vulnerabilities.

Jen Easterly, Director of CISA, commends the use of an effective SBOM solution, as it equips organizations with the capability to assess and mitigate potential risks associated with software supply chains. The integration of a dynamic SBOM feature, as offered by Mayhem Security, provides greater transparency and confidence in a manufacturer’s software development practices.

Expert Insights on ForAllSecure‘s Mayhem Security

Josh Thorngren, VP of product at ForAllSecure, stresses the significance of Mayhem Security’s dynamic SBOM solution in resolving vulnerabilities efficiently. He states, “SBOMs provide a comprehensive inventory but don’t contextualize risk. With Mayhem, teams can now quickly understand what components are on the attack surface and prioritize remediation efforts to drive down maximum time to remediation.”

With its limited beta release, Mayhem’s dynamic SBOM is set to revolutionize the way developers approach application security. By providing unparalleled insights into the runtime attack surface, Mayhem Security empowers developers to proactively address vulnerabilities and safeguard their applications from potential attacks.

About ForAllSecure

ForAllSecure, a hacker organization dedicated to advancing cybersecurity through research, education, and product development, is the driving force behind Mayhem Security. Founded in 2012 by CMU researchers, ForAllSecure has a decade of experience in building and participating in Capture the Flag (CTF) competitions, as well as collaborating with K-12 and university departments to develop cybersecurity education programs. The company gained recognition in 2016 for winning DARPA’s cyber grand challenge focused on autonomous security. Today, backed by NEA and KDT, ForAllSecure is headquartered in Pittsburgh, PA, with a global presence.

For more information about Mayhem Security and its dynamic SBOM solution, visit mayhem.security/SBOM.

Keywords: Software Security, ForAllSecure, Dynamic Software Bill of Materials, Application Security, Software Development, Cybersecurity, Vulnerability Management, Software Testing, Code Analysis, Secure Coding