~/talk

SBOM: The Rest Of the Story

on YouTube 27m
Talkat Cloud Native Security Conference North America 2021 · on Tuesday, 2021-10-12· [security, devops-and-delivery]

speakers

name:Emily Fox
linkedin:emily-fox-b7408b5
name:Nisha Kumar
links:none on file
name:Allan Friedman
linkedin:allanafriedman

resources

video:https://youtu.be/XNH-DebkJo0
slides:none on file

summary

Covers why SBOMs are a practical shared data layer not a silver bullet: SPDX and CycloneDX are the common formats, signing via sigstore helps provenance, and generating SBOMs from the build (not post hoc) is recommended to match shipped artifacts. Describes concrete checks: correlate inventories to CVE feeds, validate SBOMs with source or binary analysis, publish SBOMs in registries or via secure pointers (manufacture usage descriptor / D‑BOM), and treat SBOMs as defender tooling within an overall secure build/process set.

AI-written summary · about

chapters (8)

  1. 0:00Introductions
  2. 1:38Our Story Begins
  3. 4:24Allan Friedman
  4. 8:45Use Cases
  5. 11:40Challenges
  6. 14:04Minimums
  7. 18:14Sharing
  8. 24:13Conclusion

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.