Telco Supply Chain Security: Implementing ISO 18974 & SBOM
summary
SK Telecom lays out adopting ISO/IEC 18974 for programmatic open-source risk management, generating SBOMs in CI/CD using SPDX or CycloneDX, and running automated checks with the OpenChain Telco SBOM validator (Nokia). Supplier SBOMs will be required in pilot programs starting next March with full enforcement by 2027; SBOMs for applications containing hundreds to thousands of components speed discovery of incidents like Log4Shell from days to minutes and enable automated patching and notification workflows.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:06Telco changes and threats
- 5:03Building trust with standards
- 8:59ISO 18974 requirements
- 10:02SBOM definition and importance
- 12:09Global SBOM mandates
- 15:03SBOM standardization readiness
- 15:45OpenChain Telco WG
- 18:16Telco SBOM guide
- 21:23Mobile operator SBOM practices
- 22:06Vendor SBOM duties
- 23:09SBOM in cloud-native
- 24:36SBOM collaboration use
- 26:24Conclusion
- 28:49Execution guide
related talks
50mTowards Quality SBOMs: The OpenChain Telco SBOM Guide
26mSBOM Open Questions
30mTransparency in the Software Supply Chain: Making SBOM a Reality
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
16mSBOM, the Beginning of Transparency
41mAll About That BoM, ‘bout That BoM
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials