Bringing Service Security to a New Level: An Introduction to SaaSBOMs
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 11:00· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Defines SaaSBOM as a runtime snapshot linking one service to many SBOMs and claims SPDX and CycloneDX are building formats and profiles to express that linkage, plus CISA convenings to shape requirements. Lists concrete fields needed: unique service ID, provider identifier, endpoints, protocols, geo location, data flows and classification, uptime and dependency graph. Calls out obstacles: automated collection/observability, privacy and IP gating, lack of a service CVE database, and a tooling gap requiring SPDX service profile, CycloneDX SaaS profile, CISA Service Transparency WG.
AI-written summary · about
chapters (14)
- 0:00SaaSBOMs introduction
- 1:25Defining a service
- 4:39What is SBOM
- 7:05Why SBOM matters
- 9:55SBOM limitations
- 12:02SaaSBOM concept
- 15:38SBOM vs SaaSBOM
- 17:26Who uses SaaSBOMs
- 19:54Creating SaaSBOMs challenges
- 21:18SaaSBOMs for security
- 23:45SaaSBOMs standardization
- 27:36What’s next for SaaSBOMs
- 29:01Call to action
- 30:05Q&A
related talks
36mBringing Service Security to a New Level: An Introduction to SaaSBOMs
27mSBOM: The Rest Of the Story
44mSBOM in SaaS Environments: An Update
22mSBOM and Security Transparency - How it all fits together
45mSmarter Than Your Average SBOM!
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity