Getting Real with the Supply Chain: From SBOM Data to Action
summary
Deutsche Bahn turns SBOMs into action by centralizing generation, storage and analysis: an SBOM inventory (85,000 records now, aiming for ~150,000 and ~500,000 SBOMs/day) plus a custom compliance suite Backstage plugin that aggregates scanner outputs and surfaces prioritized issues. Adoption-first policy trades perfect metadata for coverage, uses a published red‑flag checklist and open office hours, and applies a risk-based framework balancing people, risk and value to drive targeted remediation.
AI-written summary · about
chapters (6)
- 0:00Introduction to supply chain challenges
- 2:36SBOMs as shared infrastructure
- 10:04Gaining insights from SBOM data
- 16:23Balancing people risk and value
- 22:45Conclusion and call to action
- 25:14Q&A session
related talks
57mSBOMs – The Missing Link
16mSBOM, the Beginning of Transparency
41mAll About That BoM, ‘bout That BoM
47mThe Missing Link - How we collect and leverage SBOMs
22mBuilding a Robust SBOM Solution with Backstage.io
30mTransparency in the Software Supply Chain: Making SBOM a Reality
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security