Using SBOM to stream line your application security

1. SBOM-ming Up the Pieces: Using
Software Bill of Materials to
Streamline Your Application

2. About me
• DevSecOps Engineer at Autodesk
• Previously worked at Cyware and Myglamm
• Areas of interest include: Application
Security, Threat Intelligence and Security
Automations

3. Agenda
• About SBOM
• Uses and scalability of SBOM
• Demo
• Short comings / current limitations

4. Recent Software supply chain attacks

5. SBOM to the rescue
Inventory
Package in packages
Supply chain
Known vulnerabilities Integrity verification Package evaluation
scheme:type/namespace/name
@version?qualifiers#subpath
License compliance
Why SBOM?

6. Where
SBOM?
• Secure Pipelines
• Stored in the repository
• Uploaded/Maintained in a database

7. Demo

8. Shortcomings
/ limitations
• Limited softwares to create SBOMs even
lesser to map to the vulnerabilities
• Sometimes gives generic package versions
which is hard to track at scale
• Maintaining the SBOMs at scale is a hectic
task
• Data Standardization
• SBOM requirement by US federal
government

9. Thank you!
Questions?