I Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
summary
Claims: machine-readable SBOM and VEX artifacts let teams analyze, prioritize and communicate vulnerability risk instead of arguing over vague scans. Tools actually used: CycloneDX, SPDX, Dependency‑Track, OpenVEX and multiple SBOM generators; generate SBOMs from several tools and prefer deployed binaries for fidelity. Built thing: Project Koala provides a simple publisher/consumer server for storing and discovering SBOMs and VEX with access control and integration points; it exists as a working prototype to improve sharing and auditability.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:12Vulnerability overload challenge
- 5:02Modern supply chain complexity
- 8:54Why SBOM matters
- 12:09Regulations driving SBOM
- 15:48SBOM lifecycle and risk
- 20:44Evaluating SBOM quality
- 23:37Component naming challenges
- 25:49SBOM for hardware and AI
- 28:19VEX explained
- 33:42Project Koala for SBOM/VEX
- 37:34Getting involved in SBOM
- 39:22Q&A: Risk impact in SBOMs
- 41:12Q&A: Commercial components in SBOMs
- 43:06Q&A: SBOM adoption roles
- 44:57Q&A: Scanner limits with VEX
related talks
27mSecuring Open Source With SBOM: From Visibility To Trust
36mSBOMs, VEX, and Kubernetes
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
56mFrom SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
50mSBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX
46mSafely through the dependency minefield using OWASP Dependency Track
43mA radiography of a SBOM vulnerability scanner