Want to Prevent a Cyber Attack? Prepare a Software Bill of Materials

A Software Bill of Materials (SBOM) lists all the open source and third-party components present in a codebase, and has been mandated in the US. It helps make software transparent and less vulnerable to attacks.

- Vinayak R. Adkoli

Open source software security is always in the spotlight. Every time there is a cyber attack, a lot of time and effort is required to detect not just when, where and how it occurred, but also to measure the real impact on the applications and services that are running in digital environments. Recent cyber-attacks have highlighted the general lack of knowledge about code dependencies and attacks on the software supply chain.

A Software Bill of Materials (SBOM) helps organisations to meet new domestic and international cyber security requirement laws. Supply chains point out the relationships between the various components used in building software. These components include libraries and modules. They can be open source or proprietary, and free or paid.

Why are SBOMs needed?

An SBOM is a list of all the open source and thirdparty components present in a codebase. It also lists the licences that govern those components, the versions of the components used in the codebase, and their patch status. This helps security teams to quickly identify any associated security or licence risks.

An SBOM provides a machine readable list of components of the software and its dependencies. As it has become a key component for cloud security for private and government organisations, it is estimated that 88 per cent of organisations will use SBOMs by the end of 2023.

Similarly, smart organisations that build software maintain an accurate, up-to-date SBOM, which includes an inventory of third-party and open source components to ensure that their code is of high quality, compliant, and secure.

SBOMs and cyber security