Exploring SBOMs and Software Escrow: Strategies for Securing OT Supply Chains
Summary
One way to mitigate these risks is by sharing information with a Software Bill of Materials (SBOM) to help navigate real-world attacks and the state of an organizations operational security. SBOMs are useful for software developers and manufacturers, buyers, and operators according to a GCN article that explains the US Executive Order on Improving the Nation’s Cybersecurity. The deposited materials are updated at regular agreed-to intervals and verified to make sure that the source code held in escrow is always up to date and reflects the current version of the software application. Cloud, software, and technology escrow solutions can offer legal, technical, and proportional assurance to firms in dealing with their third-party suppliers, particularly where they embrace the concept of “Resilience by Design.” Escrow agreements and verification services act as a technical insurance policy and business continuity strategy, safeguarding the long-term availability of business-critical technologies and applications while protecting intellectual property. As organizations and governments continue to explore ways to make supply chains more secure, combining the idea of SBOMs with software escrow is a new approach that can bring a multitude of benefits.