What the &#% Is in That SBOM? How to Provide Users What Software Components Are Included
summary
SBOMs are a final contract of upstream data, not a silver-bullet product: ingest and standardize with Package-URL (PURL) so components map reliably to a catalog; validate origin and license, and apply company policies before generating the SBOM. Use VulnerableCode or equivalent PURL-indexed vulnerability databases to track FOSS issues and VEXs. Prioritize traceability and a single source-of-truth data lake so SBOMs are generated dynamically and remain verifiable over time.
AI-written summary · about
chapters (12)
- 0:00SBOMs and their complexity
- 2:08SBOMs as contracts
- 5:59Tools generate SBOMs
- 9:13SBOM formats and limits
- 13:20Package URLs challenges
- 16:55Traceability gaps in SBOMs
- 21:24Storing SBOMs effectively
- 24:35Using SBOMs after generation
- 28:23Data quality over format
- 30:36Minimal SBOM fields
- 33:29SBOM field ambiguity
- 37:03Educating teams on SBOMs
related talks
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
45mSmarter Than Your Average SBOM!
27mSBOM: The Rest Of the Story
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help- 45mSmarter Than Your Average SBOM!
20mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce...
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials