SBOM in SaaS Environments: An Update
summary
CISA spins up a year-long CISA workstream in April 2023 with three subgroups and publishes a white paper defining how SBOMs apply to SaaS; the group finds existing NTIA/NIST definitions insufficient and adopts four roles — producer/operator/chooser/subscriber. Recommendations: producers produce SBOMs, operators amend them, choosers request amended SBOMs, subscribers collect service metadata (locations, protocols, SLAs, data sensitivity). Practical tooling mentioned includes OSV, OSS Scorecard and stack analysis; future work targets data governance, availability indicators, risk signals and transitive dependencies.
AI-written summary · about
chapters (8)
- 0:00SBOMs in SaaS environments
- 7:11Working group mechanics
- 16:35Redefining SaaS roles
- 21:09SBOM limitations in SaaS
- 25:45SBOM benefits by role
- 34:16Future topics and data
- 39:55Call for SaaS transparency
- 42:23Acknowledgments
related talks
36mBringing Service Security to a New Level: An Introduction to SaaSBOMs
22mSBOM and Security Transparency - How it all fits together- 36mBringing Service Security to a New Level: An Introduction to SaaSBOMs
26mSBOM today: What is the state of SBOMs?
27mSBOM: The Rest Of the Story
26mSBOM Open Questions
45mSmarter Than Your Average SBOM!
52mThe World on SBOMs