A radiography of a SBOM vulnerability scanner
summary
SBOMs are not a silver bullet but they let packaging produce a provable ingredients list so vulnerability matching beats after-the-fact dependency scanning; governments (US EO 14028, NIS2) drive adoption. Demos generate SBOMs with Syft, scan them with Grype vs bomber (bomber is slow because OSV batching delays), and target CycloneDX/SPDX formats. Claims: average app has ~150 transitive deps, cybercrime economic impact cited as $8.44T vs $450B for drug trade, Sonatype-style safety score (~350 suggested threshold) guides upgrade priorities.
AI-written summary · about
chapters (8)
- 0:00SBOMs and supply chain security
- 4:25Cybercrime’s economic impact
- 12:52Vulnerability scanning limits
- 15:45What SBOM provides
- 22:15SBOM standards and tools
- 28:35Live SBOM demo with Sift and Bomber
- 35:57Future of SBOMs and regulations
- 37:44Q&A
related talks
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
23mSBOM adopatability in open source software scanning
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
56mFrom SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
34mSo, SBOMs Matter…Now What?
29mMaking Software Bill of Materials (SBOMs) Actionable
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
45mSmarter Than Your Average SBOM!