Software Bill of Materials - Contents List for Software
summary
Explains the concept of Software Bill of Materials (SBOM) as a machine-readable inventory of all libraries, frameworks and artifacts (including Docker images) used by an application, with metadata such as versions. Demonstrates tools to automatically generate SBOMs for Java applications and shows how to use those SBOMs to find vulnerabilities in dependencies and identify potential licensing issues.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:05About me and SBOMs
- 3:13Software as parts list
- 5:24Famous security flaws
- 8:32CVE challenges
- 10:57Supply chain and open source
- 12:21Legal SBOM requirements
- 14:28NIS2 directive and critical infrastructure
- 17:18EU Cyber Resilience Act
- 19:25What is an SBOM
- 21:59Example SBOM file
- 23:25SBOM formats compared
- 24:50Java SBOM generation
- 26:33Build-time SBOM generation
- 28:01SBOM in Spring Boot
- 29:06SBOM analysis and scanners
- 31:10SBOM for Docker images
- 32:13CVE scans and databases
- 33:36Vulnerability Exploitability Exchange
- 35:05Regular SBOM checks
- 36:08License checks in SBOMs
- 37:35Component identification in SBOMs
- 40:26Relevance for Java devs
- 42:12Summary and outlook
- 42:55Q&A
related talks
31mWhat’s in the Box? Software Bill of Materials for IoT
16mSBOM, the Beginning of Transparency
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
25mA Primer on Software Bill of Materials for DevSecOps
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
38mWhat the &#% Is in That SBOM? How to Provide Users What Software Components Are Included
52mTooling up: Getting SBOMs to Scale