DBOM and SBOM: New Options For Better Supply Chain Cybersecurity
summary
A clear distinction emerges: SBOMs are machine‑readable lists of components (average >100 parts per product, some with thousands) using standards like SPDX, CycloneDX, SWID, while DBOMs are an attestation and sharing infrastructure (open‑source DBOM node code, Linux Foundation consortium) that channels those SBOMs and other provenance data. NTIA POCs (healthcare, power) expose procedural gaps more than technical ones. AI platforms ingest multi‑tier data to continuously monitor and often preempt disruptions; attackers already reconstruct SBOMs, so secrecy doesn’t stop threats.
AI-written summary · about
chapters (11)
- 0:00Introductions and overview
- 2:22Evolution of supply chains
- 5:51Understanding S-bombs
- 8:12Digital bill of materials
- 11:59Supply chain at the C-suite
- 15:53Data sharing and efficiency
- 18:28Adoption of transparency
- 23:05AI in risk management
- 27:42Standardizing infrastructure
- 30:12Dispelling transparency myths
- 31:53Government policy and outreach
related talks
27mSBOM: The Rest Of the Story
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
16mSBOM, the Beginning of Transparency
26mSBOM today: What is the state of SBOMs?
45mSmarter Than Your Average SBOM!
30mTransparency in the Software Supply Chain: Making SBOM a Reality
26mSBOM Open Questions
52mThe World on SBOMs