Keynote: SBOM is Coming: Why You Should Care and How You Can Help
summary
SBOM means a machine-readable dependency graph listing components and origins so teams can map CVEs, licenses, and maintenance risk to deployed artifacts. Standards already used are SPDX and CycloneDX, and verification tools include in-toto and spiffy plus provenance stores; registries and build systems must emit SBOMs. U.S. policy already requires SBOMs for government buys, hospitals and banks are demanding them now, and adopters report faster incident triage, clearer total-cost-of-ownership signals, and practical vulnerability cross-linking.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:54Is there anyone here who thinks supply chain isn't an issue?
- 4:19What is a Supply Chain?
- 6:39Customers!
- 13:31Part of the complete breakfast
related talks
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
27mSBOM: The Rest Of the Story
45mSmarter Than Your Average SBOM!
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
26mSBOM today: What is the state of SBOMs?
22mSBOM and Security Transparency - How it all fits together- 45mSmarter Than Your Average SBOM!
38mThe State of SBOMs