SBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX
summary
Concrete claims and usable details: CycloneDX is presented as a lightweight SBOM format used in production by 100,000 organizations, version 1.3 is current and 1.4 targets improved hardware, VEX and advisories, and tools list ~85 entries in the Tool Center. Creation methods include build-time integration, SCA output, and runtime SBOMs; signing and integrity verification are advocated; OWASP Dependency-Track and many commercial SCA products already consume CycloneDX. The emphasis is on actionable identity, services in the BOM, and automation at scale.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:39Analogy
- 2:21More SBOM Goodness
- 3:02Executive Order 14028
- 4:45SBOM Minimum Elements
- 20:37SPDX External References
- 25:20SBOM Production Options
- 35:23The CycloneDX Object Model
- 41:46Use Case Examples
- 43:08Tool Center
- 44:45CycloneDX v1.4
- 49:47Community Participation
related talks
26mFlagship Projects: CycloneDX
27mSBOM: The Rest Of the Story
40mHow I Learned to Stop Worrying and Love the SBOM
45mSmarter Than Your Average SBOM!
32mCryptographic Governance: Software Supply Chain Security With CBOM
26mSBOM today: What is the state of SBOMs?
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
36mSBOMs, VEX, and Kubernetes