SBOM Ingestion and Analysis at New York-Presbyterian Hospital
summary
An open source web app called Daggerboard ingests CycloneDX and SPDX SBOMs, cleans inconsistent package names, builds CPEs from package name+version, and matches those to NVD CVEs using a local NVD cache refreshed daily plus real‑time checks; it enriches results from ExploitDB, scores items with customizable letter grades (15 criticals yields an F in the demo), shows counts (demo: 479 total vulns), runs on Django/Docker/MariaDB and supports LDAP or local auth.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:50DaggerBoard Team
- 1:18What's In The Box?
- 2:51Introducing: Software Bill of Materials (SBOM)
- 4:46Daggerboard: Nutrition Facts for the SBOM
- 5:57SBOM at a Glance
- 6:42SBOM Tags of interest
- 7:32Tag Magic - Extracting CPE from the SBOM
- 7:58Tag Magic - Extracting Vulnerabilities from the SBOM
- 8:22Daggerboard - SBOM-Related Problems
- 10:15Daggerboard - Package Naming Inconsistencies
- 11:09Daggerboard - Development Related Problems
- 13:38The NYP Solution - Daggerboard
- 16:32How does the process work?
- 16:56Daggerboard - Dissected
- 17:30Daggerboard - Under the Hood
- 18:32How Grades Are Calculated
- 19:23Example Grade Calculation
- 20:01Roadmap
related talks
37mSBOM & Vulnerabilities in SEAPATH
43mA radiography of a SBOM vulnerability scanner
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
50mSBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX
46mSafely through the dependency minefield using OWASP Dependency Track
34mSBOMs: zero to hero in 25 mins!
34mSo, SBOMs Matter…Now What?
47mHands-On SBOM