Cloudflare CEO Matthew Prince reported on Twitter<\/a> that there were 400 confirmed exploit attempts per second<\/em>. But that\u2019s just one estimate \u2014 according to The Washington Journal, Akamai Technologies said it observed 10 million such exploit attempts per hour. Research from Check Point<\/a> also showed that the attackers were rolling out new variants of the exploits \u2014 more than 60 in under 24 hours.<\/p>\n\n\n\n That\u2019s a lot of exploits and a lot of variations to boot. Considering that the Log4j vulnerability affected major companies like Amazon, Apple, and IBM, it\u2019s no surprise that it had companies globally worried.<\/p>\n\n\n\n But what makes the situation particularly concerning is that many companies weren\u2019t aware that the products they use contained such vulnerable elements. If only there was a way that organizations could know exactly what components are part of the software they use\u2026 Oh, wait, there is: they could use products that come with a software bill of materials (SBOM).<\/p>\n\n\n\n But what is a software bill of materials and how can it help organizations mitigate some of the cyber risks facing their organizations and networks?<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span>\n\n\n A software bill of materials is a list of the base elements (such as code libraries) used to create a product. Basically, it provides details and information that outline the relationships between the various elements of the software in your supply chain. The National Telecommunications and Information Administration (NTIA)<\/a> has a bit more technical definition for an SBOM, describing it as \u201ca nested inventory for software, a list of ingredients that make up software components.\u201d It includes everything from version information and what companies created those elements.<\/p>\n\n\n\n Putting it more simply, SBOMs enable companies to know exactly what goes into their software \u2014 ideally, so they can keep a close eye on any dependencies. So, going back to the Log4j example, if you\u2019re using software that includes the vulnerable library, you would know instantly because Log4j would be listed in the SBOM. You could reach out to your vendor to ensure they\u2019re providing a patch using an updated version of Log4j. But you can\u2019t assess or mitigate specific cybersecurity risks if you don\u2019t know they exist. This is where an SBOM can help.<\/p>\n\n\n\n An analogy that\u2019s commonly used to describe these lists of components is the ingredient labels on packaged food items. (We\u2019ll speak more to that in a minute.) The purpose of an SBOM is to create transparency and help companies identify dependencies in their software supply chains. This is because, as a purchaser, you\u2019re supposed to receive or be able to access SBOMs for products you purchase. This way, you know a good amount of information about your supply chain.<\/p>\n\n\n\n SBOMs are something that can be used to address a wide variety of security issues for everything from software to IoT devices.<\/p>\n\n\n\n In fact, the May 2021 U.S. Executive Order (EO 14028) on Improving the Nation\u2019s Cybersecurity<\/a> calls upon the use of SBOMs to help strengthen the defenses of U.S. federal information systems. (Government agencies are now required to collect them from software suppliers.) The National Institute of Standards and Technology (NIST) developed the Secure Software Development Framework<\/a> (SSDF) to aid this initiative, and it requires software bill of materials information to be included.<\/p>\n\n\n\n NIST says that SBOMs are complementary to other software security processes<\/a>; they\u2019re not meant to replace other security-related functions such as cybersecurity supply chain risk management (CSCRM) activities.<\/p>\n\n\n\n In its 2021 Multistakeholder Process on Software Component Transparency document<\/a>, NTIA explains that an SBOM typically includes specific information about a product\u2019s baseline components:<\/p>\n\n\n\n For a complete list of minimum requirements, check out NTIA\u2019s SBOM Minimum Elements Report<\/a>. It breaks down the minimum elements that should be addressed in an SBOM into three main categories:<\/p>\n\n\n\n Do SBOMs have to be created at the time you\u2019re developing your software? Not necessarily. You also can create SBOMs retroactively. The only thing to note about that is that it might not be as complete as an SBOM that\u2019s generated as part of your software development life cycle (SDLC) process.<\/p>\n\n\n\n An SBOM isn\u2019t something that just anyone can look at and read easily; it\u2019s presented in one of a few standardized formats that are readable by computers (but not human beings, unless you know what to look for) to improve integration and automation. These three standards (listed in alphabetical order) include:<\/p>\n\n\n\n According to the White House\u2019s Executive Order, SBOMs benefit virtually everyone who develops, manufactures, purchases, or operates software or devices that use said software. But the truth is that a software bill of materials also indirectly benefits the consumers who are served by these companies and service:<\/p>\n\n\n\n \u201cAn SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability.”.<\/em><\/p>\n<\/blockquote>\n\n\n\n Yup. While SBOMs are typically promoted as being good for software buyers and operators, the truth is that they\u2019re also useful for broader audiences. So, you see, it\u2019s good for your organization regardless of where you fall in the supply chain.<\/p>\n\n\n\n But now that we know what an SBOM is in a general sense, let\u2019s take a closer look at this security tool and how it aids your organization\u2019s software supply chain.<\/p>\n\n\n\n Your software supply chain comprises everything from where the individual components came from that are used to create the products you use and how they\u2019re manufactured, distributed, and supported. Some categorizations of the supply chain talk about custom code, third-party components, development and building environments, delivery, etc. Basically, it\u2019s all about sourcing your components (internal or third-party dependencies), building your software, storing and deploying it, and providing ongoing support (via patches) while it\u2019s being used by the intended users.<\/p>\n\n\n\n However, to simplify things a bit more, we\u2019re going to look at what the software supply chain ecosystem looks like based on a traditional supply chain (based on information shared in NTIA\u2019s SBOM explainer video<\/a>):<\/p>\n\n\n\n Let\u2019s imagine, for a moment, that you\u2019re an IoT device manufacturer that uses third-party software as part of your supply chain. This is how the above breakdown would play out with regard to you and your business:<\/p>\n\n\n\n When you\u2019re at the grocery store, do you stop to read product nutrition labels and ingredient lists? If you\u2019re like me, you do because you want to know exactly what you\u2019re putting into your body.<\/p>\n\n\n\n It\u2019s a good idea to take a similar approach when adding software and devices to your network. If you want to keep your network secure, then you\u2019ll want to check every device, software, or system carefully you connect to it for known vulnerabilities. Knowing what libraries, drivers, operating systems and open source resources are used goes a long way in helping you assess and mitigate vulnerabilities.<\/p>\n\n\n\n Let\u2019s consider a quick example with one of my favorite special occasion meals: Fettucine alfredo. Say, a friend is having a small get-together at her house and I decide to bring over a dish of homemade fettuccine alfredo for the occasion to share. Sounds great, right? It is, so long as no one has any food allergies to any of the ingredients I\u2019m using in my dish.<\/p>\n\n\n\n But how can someone tell whether there might be something in my fettuccine alfredo that might cause an issue? Let\u2019s first consider the list of ingredients. My fettuccine alfredo recipe is pretty simple as it contains several basic ingredients:<\/p>\n\n\n\n If I were to break up this item, we\u2019d be looking at the following breakdown of items:<\/p>\n\n\n\n Looks simple enough, right? Not quite\u2026 There\u2019s more to it because of the \u201chidden ingredients\u201d that people might not know about if they aren\u2019t disclosed.<\/p>\n\n\n\n A few of these items \u2014 the two cheese and the gluten free flour \u2014 are created through manufacturers whose products I like and trust. So, knowing this, let\u2019s consider the supply chain for these items \u2014 particularly the compound components. These items may have other additives that I might not be aware of unless I stop to read the product label. Let\u2019s consider a quick example using parmesan cheese.<\/p>\n\n\n\n The ingredients for the brand of parmesan cheese I typically use contains cultured cow\u2019s milk, enzymes, and salt. (Note: If I bought the pre-grated variety, additional components would be added, such as cellulose and natamycin \u2014 this is why I buy the blocks of cheese and grate them myself!) So, in this case, that means the enzymes and cultured milk need to be added to my list of ingredients.<\/p>\n\n\n\n Likewise, if I looked at the ingredient list for the Pecorino-Romano cheese or the gluten free flour I\u2019d use, there would be several additional items I\u2019d need to add to my list of components. And it would also be important to know where the ingredients the manufacturers used actually came from. For example:<\/p>\n\n\n\n This means my ingredient list now looks more like this:<\/p>\n\n\n\n See how much longer the list of ingredients became now that we\u2019ve added all of these \u201chidden\u201d ingredients? Now, ask yourself what would happen if one of your friends was allergic to milk, tapioca flour, or eggs but you didn\u2019t know it. If they didn\u2019t know those ingredients were included in the meal, it could lead to a potentially serious medical emergency, depending on the severity of their allergic reaction.<\/p>\n\n\n\n Likewise, similar concerns apply to your software and hardware devices. While the concern isn\u2019t a food allergy or medical concern necessarily, not knowing what\u2019s included in your software supply chain leaves your organization, network, and customers at risk. Knowing the A-Z of your software supply chain and its security<\/a> helps you stay abreast of any potential vulnerabilities and exploits you need to address before bad guys use them to attack your network and organization. This is crucial for risk analysis and mitigation activities, where you need to know how and where your systems are vulnerable. <\/p>\n\n\n\n The truth is that it\u2019s rare to find a company that builds its software or hardware components entirely from scratch. (Doing so is just too complex, costly, and time consuming.) Instead, they integrate third-party and open source elements such as frameworks and libraries. When you consider that these components often operate with the same permissions as the software they\u2019re a part of, it means the risk can be significant.<\/p>\n\n\n\n SBOMs help you have a better understanding of your software supply chain and everything involved in it. They also help you better manage and mitigate risks by using them to analyze known vulnerabilities. This is why it\u2019s best for them to be stored in a centralized repository that applications and systems can easily access and use.<\/p>\n\n\n<\/span>\n\n\n As with any electronic file, yes, there\u2019s always a risk of that happening. However, there are safeguards that could be used to prevent digital tampering and to prove something is legitimate. One such method is to digitally sign your file before releasing it with your software. A digital signature<\/a> is a way to simultaneously show that your file is authentic and hasn\u2019t been tampered with since it was signed. <\/p>\n\n\n\nWhat Is a Software Bill of Materials (SBOM)?<\/h2>\n\n\n\n
Even the U.S. Government Encourages Using SBOMs to Improve Security<\/h3>\n\n\n\n
What Types of Information SBOMs Should Include<\/h2>\n\n\n\n
\n
\n
SBOMs Are Typically Meant to Be Read By Machines, Not People\u2026.<\/h3>\n\n\n\n
\n
![\"An](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/11\/ntia-sbom-example-shadow-759x1024.png\")
Who a Software Bill of Materials Benefits (Spoiler Alert: Everyone)<\/h2>\n\n\n\n
\n
A Look at How a Software Bill of Materials Breaks Things Down Within the Supply Chain<\/h2>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/11\/software-supply-chain-basic-example.png\")
\n
An SBOM Is Like the List of Ingredients You\u2019d Find in Your Favorite Foods\u2026<\/h3>\n\n\n\n
\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/11\/list-of-compound-ingredients-1024x631.png\")
<\/figure>\n\n\n\nSome Ingredients Are Made Up of Other Unknown Ingredients<\/h3>\n\n\n
![\"An](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/11\/sbom-food-nutrition-label-example-shadow.png\")
\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/11\/extended-list-of-compound-base-ingredients-1024x873.png\")
<\/figure>\n\n\n\nWhy You Need to Know Which Ingredients Are Included in Your Software<\/h2>\n\n\n\n
Can\u2019t a Software Bill of Materials Be Faked?<\/h2>\n\n\n\n