The document is a presentation on SBOMs (Software Bill of Materials) given by Bill Bensing. It discusses the history of SBOMs including key standards and the 2021 US Executive Order mandating their use. It outlines the reasons for using SBOMs such as identifying license, vulnerability, and component issues. The presentation covers SBOM basics, challenges around current tooling and automation, and provides guidance on effective SBOM processes.

1. v1.0.0
DevOps Days Tampa Bay - 2022
SBOM, Is It 42?
Bill Bensing October 21, 2022
1

2. v1.0.0
Beyonce Rule
2
If You Like It, Then You Should Tweet On It
@BillBensing

3. v1.0.0
3
“Make the right way, the easy and
default way, for anyone who wants to
build software.”
Bill Bensing
Global Lead - Application Delivery
Red Hat Customer Success

4. v1.0.0
4
Investments Unlimited
A Novel About DevOps, Security, Audit Compliance, and
Thriving in the Digital Age
By Helen Beal, Bill Bensing, Jason Cox, Michael Edenzon, Dr. Tapabrata "Topo"
Pal, Caleb Queern, John Rzeszotarski, Andres Vega, and John Willis
https:/
/itrevolution.com/investments-unlimited-book

5. v1.0.0
5
! WARNING !

6. v1.0.0
6
I Have Never Watched
Hitchhiker's Guide All The
Way Through

7. v1.0.0
7
Do You Know What 42 Is?

8. v1.0.0
8
The Answer To Life…

9. v1.0.0
9
I Only Know What 42 Means
Because Of Jeopardy

10. v1.0.0
10
So…

11. v1.0.0
11
I Will Not Get ANY Movie
References Beyond 42

12. v1.0.0
12
Well, the ones not included
in this talk.

13. v1.0.0
13
The Bottom Line Up Front

14. v1.0.0
14
If You Do Not Have
Good SCA Hygiene

15. v1.0.0
15
SCA
Software Composition Analysis

16. v1.0.0
16
Focus on SCA First

17. v1.0.0
17
Then, Think About SBOMs

18. v1.0.0
18
1. Brief SBOM History
2. Why An SBOM?
3. SBOM Basics
4. SBOM Problems
5. Hitchhiker's Guide to SBOMs
Agenda

19. v1.0.0
Brief SBOM History
19

20. v1.0.0
SBOM History
20
▸ No “Source of Truth” for history
▸ 2010 - SPDX created (Linux Foundation)
▸ 2017 - CycloneDx Created (OWASP)

21. v1.0.0
Two Main Types (Formats) of SBOMs
21
The Diagnosis
Source: https://www.settletop.com/insights/understanding-sbom-standards-cyclonedx-spdx-swid
● Software Package Data Exchange
● Focus on open source license compliance
● More focused on vulnerability and security
● Open source license, vulnerability
identification, outdated component analysis
SPDX CycloneDX

22. v1.0.0
SBOM History
22
The Diagnosis

23. v1.0.0
23
Source: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
Executive Order on Improving The Nation’s Cybersecurity
May 12, 2021

24. v1.0.0
24
Source: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
Sec. 2. Removing Barriers to Sharing Threat Information.
(vii) providing a purchaser a Software Bill of Materials
(SBOM) for each product directly or by publishing it on a
public website;
Sec. 2. Removing Barriers to Sharing Threat Information.
(f) Within 60 days of the date of this order, the Secretary of
Commerce, in coordination with the Assistant Secretary for
Communications and Information and the Administrator of
the National Telecommunications and Information
Administration, shall publish minimum elements for an SBOM.
Executive Order on Improving The Nation’s Cybersecurity
May 12, 2021

25. v1.0.0
25
Source: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
CISA Binding Operational Directive - BOD 22-01
Nov. 03, 2021

26. v1.0.0
Why An SBOM
26

27. v1.0.0
27
Analogy - A Food Label
Tells You What You’re Consuming

28. v1.0.0
28
So, Why use SBOMs?

29. v1.0.0
29
SBOMs are Decision Support
for Software Composition

30. v1.0.0
30
Focused On Software &
System Composition Analysis

31. v1.0.0
31
1. License Evaluation

32. v1.0.0
32
2. Known Vulnerabilities

33. v1.0.0
33
3. Outdated Components

34. v1.0.0
34
Two Additional Aspects of Software

35. v1.0.0
35
Pedigree

36. v1.0.0
36
Provenance

37. v1.0.0
37
SBOMs Help Us To Answer
Questions Such As…

38. v1.0.0
38
How Do We Detect The
Next Log4Shell?

39. v1.0.0
The Problem
39
What Does It Mean To Detect Log4Shell?
▸ Companies want
･ Be notified as soon as possible of a vulnerability is identified
･ Needs to know what specific software is affected
･ Needs to know where the affected software is stored, or
running
▸ This information is the basis of their plans to resolve the problem.

40. v1.0.0
The Problem
40
What Does It Mean To Detect Log4Shell?
▸ How It Happens
･ Detect vulnerability when I build software
･ Detect vulnerability while my software is at rest, in a repository
･ Detect vulnerability while my software is running in production
･ Detect vulnerability when I download public repos to my
internal repo mirrors
･ Detect vulnerability when I deploy my software

41. v1.0.0
SBOM Basics
41

42. v1.0.0
42
Source: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
Executive Order on Improving The Nation’s Cybersecurity
May 12, 2021

43. v1.0.0
43
Source: https://www.ntia.doc.gov/report/2021/minimum-elements-software-bill-materials-sbom
NTIA Response To The Executive Order
July 12, 2021

44. v1.0.0
44
Source: https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
NTIA Response To The Executive Order
July 12, 2021
NTIA SBOM Fields SPDX CycloneDx
Supplier Name (3.5) PackageSupplier: publisher
Component Name (3.5) PackageSupplier: name
Unique Identifier (3.2) SPDXID: bom/serialNumber and component/bom-ref
Version String (3.3) PackageVersion: version
Component Hash (3.10) PackageChecksum: hash
Relationship (3.10) PackageChecksum:
CONTAINS
(Nested assembly/subassembly and/or dependency
graphs)
Author Name (2.8) Creator: bom-descriptor:metadata/manufacture/contact

45. v1.0.0
45
Source:https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_formats_energy_brief_2021.pdf

46. v1.0.0
Classifying SBOM Tools
46
Tools Types That Produce SBOMS
Source: https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_formats_energy_brief_2021.pdf
▸ Build
･ SBOM is automatically created as part of building a software
artifact and contains information about the build.
▸ Manual
･ A person will manually fill in the SBOM information
▸ Analysis
･ Analysis of source or binary files will generate the SBOM by
inspection of the artifacts and any associated sources.

47. v1.0.0
Classifying SBOM Tools
47
Tool Types That Consume SBOMs
Source: https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_formats_energy_brief_2021.pdf
▸ View
･ Understand the contents in human readable form (picture,
figures, tables, text.). Use to support decision making &
business processes.
▸ Diff
･ Compare two documents of a given formation and clearly see
the differences. For instance, comparing between two versions
of a piece of software.
▸ Import
･ Import an SBOM into your system for further processing.

48. v1.0.0
Classifying SBOM Tools
48
Tools Types That Transform SBOMs
Source: https://www.ntia.doc.gov/files/ntia/publications/ntia_sbom_formats_energy_brief_2021.pdf
▸ Translate
･ Change from one file type to another file type while preserving
the same information.
▸ Merge
･ Multiple sources of documents can be merged together for
analysis and audit purposes
▸ Tool Support
･ Support use in other tools by APIs, object models, libraries, or
other reference sources.

49. v1.0.0
49
Two Guiding Principles

50. v1.0.0
50
GP #1
Scan Once, Continuously
Verify

51. v1.0.0
Scan Once, Continuously Verify
51
#1 Guiding Principle
▸ Generate an SBOM in your CI pipeline
▸ Persist the SBOM
▸ Evaluate the SBOM
･ Hourly/Daily/Weekly automated reviews
･ Ad-Hoc notifications & queries

52. v1.0.0
52
GP #2
CIA Assessment For Action

53. v1.0.0
CIA Assessment for Actions
53
#2 Guiding Principle
Source: (ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide, 9th Edition
▸ Confidentiality
･ Measures used to ensure the protection
of the secrecy of data, objects, or
resources.
▸ Integrity
･ Concept of protecting the reliability and
correctness of data.
▸ Availability
･ Authorized subjects are granted timely
and uninterrupted access to objects.

54. v1.0.0
SBOM Problems
54

55. v1.0.0
55
If I Gave You an SBOM
Today

56. v1.0.0
56
How Would You Handle It?

57. v1.0.0
57
What Would You Do With It?

58. v1.0.0
58
What Actions Would It Drive?

59. v1.0.0
59
My Bet…

60. v1.0.0
60
NONE
At Least Right Now

61. v1.0.0
61
Why?

62. v1.0.0
62
Answer My Question
With Another Question

63. v1.0.0
63
How Does Your Own SCA Work?

64. v1.0.0
64
Non-Existent? Poorly? Good?

65. v1.0.0
65
How Would You
Use An SBOM To…

66. v1.0.0
66
Assess Known Vulnerabilities?

67. v1.0.0
67
Or…

68. v1.0.0
68
Take Action On An
Outdated Component?

69. v1.0.0
69
To Do This Well

70. v1.0.0
70
100% Automated Software Testing

71. v1.0.0
71
For Example…

72. v1.0.0
72
Can You Auto-Merge A POM
Revision In Your Company?

73. v1.0.0
73
Without Breaking All The Things?

74. v1.0.0
74
SBOMs Are Great For Helping To
Make Decisions

75. v1.0.0
75
BUT…

76. v1.0.0
76
If You Can’t Take Effective Action

77. v1.0.0
77
What Is This All Worth Then?

78. v1.0.0
Hitchhiker’s Guide to
SBOMs
78

79. v1.0.0
79
Don’t Forget Your Towel
(aka SCA)

80. v1.0.0
80
#1
Effective SCA Process For SDLC

81. v1.0.0
81
#2
Automated SBOM Generation

82. v1.0.0
82
#3
Automated SBOM Ingestion

83. v1.0.0
83
AutoGov
Demo

84. v1.0.0
84
So Long,
And Thanks For All The Fish

85. v1.0.0
linkedin.com/company/red-hat
youtube.com/user/RedHatVideos
facebook.com/redhatinc
twitter.com/RedHat
No Questions
Just Conversations
85
Bill Bensing
Red Hat Customer Success
Global Lead - Application Delivery
Home billbensing.com
LinkedIn linkedin.com/in/billbensing
Twitter @BillBensing

86. v1.0.0
86
You Probably
Don’t Need An SBOM Capability

87. v1.0.0
87
Just Yet, Unless…

88. v1.0.0
88
Your Customer Requires One

89. v1.0.0
89
By Customer, I Mean…

90. v1.0.0
90
A U.S. Government Entity

91. v1.0.0
91
SBOM Is Being Driven By
the U.S. Government

92. v1.0.0
92
Directly To The Defense Industrial
Base