Software bill of materials is about more than compliance, expert says
Matt Anderson Photography/Getty Images
Connecting state and local government leaders
As organizations look to hammer out the standards for SBOMs, they’re also looking at how to automate the vulnerability checking process.
As software bills of materials (SBOMs) gain traction in the federal government, state, local and tribal agencies are likely to also begin using them, an expert said.
An SBOM is a formal record of the details and supply chain relationships among the components in software, or basically an ingredients list, said Lena Smart, chief information security officer at MongoDB, a database platform.
But ingredients change, which means maintaining accurate SBOMs can get complex, she added. “That can make life interesting for people who think this is just a box-ticking exercise. I don’t think it is,” Smart said. “I think we’re going to see a lot more interest in it as we start to get traction on this.”
The Executive Order on Improving the Nation’s Cybersecurity calls out SBOMs, explaining their usefulness for software developers and manufacturers, buyers and operators. “An SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities,” the order states. “Buyers can use an SBOM to perform vulnerability or license analysis … and those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability.”
The biggest value comes when SBOMs are stored collectively in a repository that many applications and systems can query, the order adds.
Currently, organizations looking to find and manage vulnerabilities check the National Vulnerability Database for Common Vulnerabilities and Exposures, but without an SBOM, they have no way to identify the components of a software package. SBOMs would provide a way to track software dependencies across supply chains, manage vulnerabilities and anticipate emerging risks.
Allan Friedman, a senior adviser and strategist at the Cybersecurity and Infrastructure Security Agency (CISA), is leading efforts to coordinate SBOM creation and use within and beyond the government. The Open Web Application Security Project (OWASP) is a nonprofit that is working to develop an SBOM standard. In January, it released version 1.4 of its CycloneDX SBOM standard, which added the Vulnerability Exploitability Exchange to enable the “ability to communicate vulnerabilities and their exploitability for software-defined in a bill of materials.”
Smart consulted with both Friedman and Patrick Dwyer, project lead at OWASP, on the development of an SBOM that MongoDB has been using internally. It uses Snyk software to check for, detect and report vulnerabilities in existing software and the MongoDB database to store data on the back end. Application programming interfaces handle continuous monitoring so when there’s a change in the software stack, Snyk would note it, compare it against the information in the database and update the SBOM.
“We’re working now on the API for automation,” Smart said. “We need to automate this stuff. We can’t do this manually.”
She expects that several frameworks for SBOMs will eventually emerge but that it’s too soon to say exactly what they’ll entail.
“The easiest way to think of it is like the sausage factory,” Smart said. “We know all the ingredients, we know where they’re going, we just don’t know what the sausage is going to look like yet because we haven’t got the framework built for it.”
SBOMs are akin to PBOMs, or physical bills of materials. Formerly the CIO and chief security officer at the New York Power Authority, Smart said employees would travel to China to inspect metal before purchasing it for use in turbines. They’d mark their selections so they could verify that the pieces that arrived in the states were the same. “I know that’s very rudimentary and very basic, but it worked because our suppliers knew that we took it that seriously,” Smart said.
With digitization, the weakest link will be the small power plant or local entity that’s feeding data up to the federal government, she said, adding that she expects that federal agencies will require SBOMs from public- and private-sector organizations it works with. “In order to maintain the trust within state and local up to federal, I think we’re going to see proliferation and a ubiquity of SBOMs in state and local,” she said.
To prepare for this, state and local agencies should take stock of the software they use now and determine what it would take to get each ingredient list.
“You can’t secure what you can’t see,” Smart said.
Stephanie Kanowitz is a freelance writer based in northern Virginia.