Asleep at the Wheel: Getting your SBOMs to pay attention...
summary
Claim: SBOM blind spots come from observing metadata instead of builds. Toolchain: SBOMit consumes witness/in-toto attestations to record file accesses, processes, and network calls during build. Result: analysis of 5,000 Docker Hub images finds 30% of files untracked, enriched SBOMs expose bundled native libs and mismatched runtimes, and demos show enforceable CI policies that block unexpected network activity and flag unexplained files, producing verifiable SBOMs rather than guesses.
AI-written summary · about
chapters (7)
- 0:00Hidden Python dependencies
- 3:56Pip freeze limitations
- 9:34SBOM generation limits
- 12:45Introducing SBOMit
- 18:24Enriching SBOMs with attestations
- 25:53Key takeaways
- 29:28Q&A
related talks
41mYour SBOM Is Lying To You – Let’s Make It Honest
32mSBOMit: Making SBOMs Accurate With Attestations
46mSBOMs Are Not Enough
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
45mSmarter Than Your Average SBOM!
50mRealities of SBOM: What Is Under the Hood of SBOM?
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture