Standard Classification: What Shall We Do With a Vendor SBOM?
summary
SBOMs arrive as concrete inventories and demand decisions: use them for pre‑procurement gating (license and provenance checks), for annotated vulnerability disposition and audit evidence, and for forensics only when logs and install timelines exist. Expect a big data flood, limited automation, and negotiation when binary scanners disagree (internal Cisco data shows 60 percent accuracy). Don’t assume instant blocking—blocking is breaking—and plan policy for SaaS chains, social‑graph noise, remediation timelines, and who actually needs deep analysis.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:18Precurement
- 5:17Vulnerability Disclosure
- 8:49Learning from Threat Intelligence
- 16:49Learning from Forensics
- 16:59How important is it
- 21:40More thoughts
- 25:07Resources
related talks
45mSmarter Than Your Average SBOM!
57mSBOMs – The Missing Link
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
23mSBOM adopatability in open source software scanning
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture