SBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce...
summary
Based on experience supporting SBOM programs across industries including managing 1,800 repositories and 600 applications with a three-person team, practical rules emerge: generate SBOMs as close to the final production artifact as possible, prefer SPDX or CycloneDX in JSON, and include standalone VEX files for ongoing vulnerability status. Use package URL (purl) as the primary identifier and avoid CPE where possible. Three common scenarios covered are generation and distribution for customers and regulators, aggregation for centralized vulnerability triage and SSVC prioritization, and two‑way ingestion from external suppliers.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 2:25Why SBOMs matter
- 6:35Generating and distributing SBOMs
- 11:10Aggregating SBOMs for prioritization
- 17:24Enforcing SBOM standards
- 20:09Q&A
related talks
57mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Scenarios
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
26mSBOM today: What is the state of SBOMs?
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
46mSBOMs Are Not Enough
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
45mSmarter Than Your Average SBOM!