A Primer on Software Bill of Materials for DevSecOps
summary
Demonstrates how to enumerate and act on real dependencies rather than theory: generates an SBOM from a container image with a lightweight generator that queries vulnerability databases, finds 15 components in the example image, shows dependency graphs and a reported vulnerability, compares CycloneDX and SPDX formats, and explains adoption steps — standards, tooling, continuous generation, and stakeholder reporting — with a short live container image scan and SBOM generation demo.
AI-written summary · about
chapters (10)
- 0:00Introduction and Speaker Background
- 0:26Understanding DevSecOps
- 0:56Exploring Software Supply Chain
- 2:26Real-World Supply Chain Attacks
- 6:01Mitigating Supply Chain Attacks
- 7:13Introduction to Software Bill of Materials (SBOM)
- 9:35SBOM Standards and Tools
- 12:26SBOM Generation Demo
- 23:44Adopting SBOM in DevSecOps
- 24:46Conclusion and Resources
related talks
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
29mMaking Software Bill of Materials (SBOMs) Actionable
23mSupply Chain Security using Free and Open Tools
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
47mSoftware Bill of Materials - Contents List for Software