Is SBOM for the Cloud Even a Thing?
summary
SBOMs for networked cloud services prove limited because services are not distributed products; a list of packages rarely tells whether an API path is exploitable or how multitenant configs isolate data. Work here produces a minimal data set, uses tools like Turn for container inventories, standards like SPDX 3.0, and vulnerability exchange VEX for status, and recommends storing signed artifacts in container registries (Merkle DAGs, cosine/signing) while leaning on provider shared responsibility models.
AI-written summary · about
chapters (10)
- 0:00SBOM for the Cloud
- 4:05Government push for SBOM
- 7:16Cloud provider attacks
- 12:20Cloud SBOM working groups
- 14:24Shared cloud responsibility
- 20:29SaaS versus on-prem software
- 22:59SBOM use cases in cloud
- 28:03Why traditional SBOMs fail
- 31:37Key takeaways and call to action
- 36:14Q&A
related talks
38mThe State of SBOMs
27mSBOM: The Rest Of the Story
44mSBOM in SaaS Environments: An Update
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
36mBringing Service Security to a New Level: An Introduction to SaaSBOMs
46mSBOMs Are Not Enough
45mSmarter Than Your Average SBOM!
26mSBOM today: What is the state of SBOMs?