Cyberattack Gold: SBOMs Offer an Easy Census of Vulnerable Software
Summary
An attacker who determines what software a targeted company is running, can retrieve the associated SBOM, and analyze the applications components for weaknesses, all without sending a single packet, says Larry Pesce, a director for product security research and analysis at software supply-chain security firm Finite State. SBOMs are quickly proliferating, with more than half of companies currently requiring that any application be accompanied by a list of components — a number that will reach 60% by next year, according to Gartner. Efforts to make SBOMs a standard practice see transparency and visibility as the first steps to help the software industry better secure their products. The concept has even spread to the critical infrastructure sector, where energy giant Southern Company embarked on a project to create a bill of materials for all the hardware, software, and firmware in one of its substations in Mississippi. The minimum baseline for SBOM data fields include the supplier, the component name and version, dependency relationships, and a timestamp of when the information was last updated, according to the US Department of Commerce guidelines.