SBOMs, VEX, and Kubernetes
summary
Pick one of the SBOM formats (CycloneDX or SPDX) and generate SBOMs at build time as part of CI; treat signing and provenance as phase two work and add VEX later to mark exploitability. Store SBOMs next to the artifact (registries like JFrog/Artifactory or a file repo) with proper access controls and lifecycle rules. Use SCA and reachability analysis (CodeQL, semgrep, tree‑shaking) for proactive triage, admission control for operational blocking, and GUAC-style tooling for reactive searches and incident response.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:04SBOMs for supply chain security
- 3:51SBOM formats and June prep
- 10:56VEX and signed SBOMs
- 16:51SBOM creators and stages
- 22:10Secure SBOM storage and sharing
- 27:23Asking vendors for SBOMs
- 31:38Using SBOMs for security
- 35:48Q&A
related talks
27mSBOM: The Rest Of the Story
45mSmarter Than Your Average SBOM!
46mSBOMs Are Not Enough
20mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce...
35mTransforming SBOMs from Compliance Burden to Security Asset
57mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Scenarios- 45mSmarter Than Your Average SBOM!
38mThe State of SBOMs