Bringing Service Security to a New Level: An Introduction to SaaSBOMs
summary
Defines a SaaSBOM as a snapshot linking one service to many SBOMs plus service metadata like service identifier, data flow and classification, geographic hosting, protocols and uptime, and shows standards work under way: CISA advisory meetings, an SPDX Service Profile (targeting SPDX 3.x) and a CycloneDX SaaS profile. Demonstrates concrete uses — vulnerability applicability, policy enforcement, audits — and calls out the current gaps: tooling to generate SaaSBOMs, integration with runtime observability, and privacy/IP controls for internal vs shared metadata.
AI-written summary · about
chapters (14)
- 0:00SaaSBOMs introduction
- 1:25Defining a service
- 4:39What is SBOM
- 7:05Why SBOM matters
- 9:55SBOM limitations
- 12:02SaaSBOM concept
- 15:38SBOM vs SaaSBOM
- 17:26Who uses SaaSBOMs
- 19:54Creating SaaSBOMs challenges
- 21:18SaaSBOMs for security
- 23:45SaaSBOMs standardization
- 27:36What’s next for SaaSBOMs
- 29:01Call to action
- 30:05Q&A
related talks
36mBringing Service Security to a New Level: An Introduction to SaaSBOMs
44mSBOM in SaaS Environments: An Update
27mSBOM: The Rest Of the Story
45mSmarter Than Your Average SBOM!
22mSBOM and Security Transparency - How it all fits together
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
53mIs SBOM for the Cloud Even a Thing?
26mSBOM today: What is the state of SBOMs?