Unlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
summary
SBOM analysis pipeline automates ingestion, runs scanners (Dependency-Track, Prisma Cloud, Twistlock, Fossa) and produces a standardized business-friendly report plus a VEX spreadsheet, cutting assessment time by 95% reduction. Findings show 80% of vulnerabilities would be fixed by updating to latest library versions; 22% non-production code and 27% scanning/config issues add noise; ~40% of SBOMs contain vulnerability-data mismatches. Practical gaps include versionless components, cargo.lock vs cargo.toml blind spots, and secure iterative sharing with vendors.
AI-written summary · about
chapters (11)
- 0:00SBOMs introduction
- 3:16Business context for SBOMs
- 5:05Risk management use cases
- 8:59Vulnerability analysis in SBOMs
- 12:05Automating SBOM analysis
- 14:57Sharing SBOMs with vendors
- 17:06SBOM noise and inaccuracies
- 23:01Improving SBOM accuracy
- 25:05Benefits of automated SBOMs
- 26:51Contributing to SBOM tools
- 27:32Q&A on SBOM antipatterns
related talks
43mA radiography of a SBOM vulnerability scanner
27mSecuring Open Source With SBOM: From Visibility To Trust
01h 16mCybersecurity with CDF & OpenSSF Focus Group
29mMaking Software Bill of Materials (SBOMs) Actionable
45mSmarter Than Your Average SBOM!- 45mSmarter Than Your Average SBOM!
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
47mThe Missing Link - How we collect and leverage SBOMs