Software supply chain
A software bill of materials[1] (SBOM) is a list of components in a piece of software. Software vendors often create products by assembling open source and commercial software components. The SBOM describes the components in a product.[2][3] It is analogous to a list of ingredients on food packaging.
The concept of a BOM is well-established in traditional manufacturing as part of supply chain management.[4] A manufacturer uses a BOM to track the parts it uses to create a product. If defects are later found in a specific part, the BOM makes it easy to locate affected products.
An SBOM is useful both to the builder (manufacturer) and the buyer (customer) of a software product. Builders often leverage available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities.[5] Buyers can use a SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Although many companies use Microsoft Excel[6] for general BOM management, there are additional risks and issues using a spreadsheet for an SBOM. SBOMs gain greater value when collectively stored in a repository that can be easily queried by other applications and systems.
Understanding the supply chain of software, obtaining a SBOM, and using it to analyze known vulnerabilities are crucial in managing risk.[7][8][9]
The Cyber Supply Chain Management and Transparency Act of 2014[10] was US legislation that proposed to require government agencies to obtain SBOMs for any new products they purchase. It also would have required obtaining SBOMs for "any software, firmware, or product in use by the United States Government". Though it ultimately didn't pass, this act did bring awareness to government and spurred later legislation such as "Internet of Things Cybersecurity Improvement Act of 2017."[11][12]
The US Executive Order on Improving the Nation’s Cybersecurity of May 12, 2021[13] ordered NIST to issue guidance within 90 days to "include standards, procedures, or criteria regarding" several topics in order to "enhance the security of the software supply chain," including "providing a purchaser a Software Bill of Materials (SBOM) for each product." Also mandated within 60 days was for NTIA to "publish minimum elements for an SBOM."
References
- ^ "Software Bill of Materials". ntia.gov. Retrieved 2021-01-25.
- ^ "Securing A Mobile World" (PDF). Crosstalkonline.org. Retrieved 2015-06-12.
- ^ "[Part 2] Code, Cars, and Congress: A Time for Cyber Supply Chain Management". Retrieved 2015-06-12.
- ^ "Code, Cars, and Congress: A Time for Cyber Supply Chain Management". Retrieved 2015-06-12.
- ^ "Software Bill of Materials improves Intellectual Property management". Embedded Computing Design. Retrieved 2015-06-12.
- ^ "Using Excel for Bill of Materials (BOM) Management". Retrieved 2018-08-02.
- ^ "Appropriate Software Security Control Types for Third Party Service and Product Providers" (PDF). Docs.ismgcorp.com. Retrieved 2015-06-12.
- ^ "Top 10 2013-A9-Using Components with Known Vulnerabilities". Retrieved 2015-06-12.
- ^ "Cyber-security risks in the supply chain" (PDF). Cert.gov.uk. Retrieved 2020-07-28.
- ^ "H.R.5793 - 113th Congress (2013-2014): Cyber Supply Chain Management and Transparency Act of 2014 - Congress.gov - Library of Congress". Retrieved 2015-06-12.
- ^ "Internet of Things Cybersecurity Improvement Act of 2017" (PDF). Retrieved 2020-02-26.
- ^ "Cybersecurity Improvement Act of 2017: The Ghost of Congress Past". Retrieved 2020-02-26.
- ^ "Executive Order on Improving the Nation's Cybersecurity". The White House. 2021-05-12. Retrieved 2021-06-12.