In 2021, President Joe Biden signed an Executive Order highlighting the importance of the software bill of materials (SBOM) in cybersecurity. While SBOMs existed even before the Executive Order on Improving the Nation’s Cybersecurity, they weren’t quite as standardized or recognized as they are today. Before the 2021 Executive Order, software tracking and managing supply chains was a challenging and often opaque process. Organizations would acquire software solutions without full visibility into the various components and dependencies that comprise those solutions. Because of this, many organizations were highly susceptible to cyberattacks and supply chain disruptions.
Read on to discover the significance of the software bill of materials in modern software development and cybersecurity.
📖 Software Bill of Materials (SBOM) Definition
A software bill of materials is a detailed list of all the software components and dependencies that make up a particular piece of software or an application. It’s similar to the bill of materials (BOM) used in industries such as manufacturing and engineering because it provides transparency and visibility into the composition of a software application.
The evolution of SBOMs can be likened to the evolution of nutritional labels on food products. In the past, people consumed food without detailed knowledge of its ingredients, often trusting that it was safe. However, when food allergies became a national concern, the government issued mandates for food companies, requiring them to have labels detailing all the ingredients on food products.
📝 The Minimum Elements for an SBOM
After the Executive order was issued in May 2021, the United States Department of Commerce coordinated with the National Telecommunications and Information Administration (NTIA) to release a document that listed the important things organizations needed to include in a Software Bill of Materials. These include:
Data Fields
Data fields in an SBOM provide detailed information about each software component or dependencies within a given software application. They typically include the following information:
- Component Name
- Supplier Name
- Version
- Software Dependencies
- Unique Identifiers
- Software Bill of Materials Data Author
- Timestamp
Automation Support
Creating SBOMs is a rather complicated and tedious task when approached manually. However, automation can make this process easier, more efficient, and less time-consuming. NTIA recommends organizations to automate the generation process and data transfer. With automation, organizations can use automated tools to scan software applications and their dependencies, generate reports, and conduct analysis of SBOM data. This can help to identify trends, potential risks, and areas for improvement. It also saves time and ensures that the SBOM remains up-to-date as the software evolves.
Data transfer automation requires organizations to use machine and human-readable data formats and standards to ensure that SBOMs can be easily generated, shared, and analyzed. These data standards include:
- Software Package Data eXchange (SPDX)
- CycloneDX
- Software Identification (SWID) tags
Practices and Processes
Software developers and organizations must also include the operational details in an SBOM for any contract that asks for them. These details outline the methods and workflows organizations implement to create and maintain SBOMs. According to NTIA, some processes are straightforward (frequency), while others are complicated. In cases where multiple practices exist, organizations must meet the minimum elements.
- Frequency: This refers to how often software developers update and review their SBOMs. NTIA recommends regularly scheduling reviews and updates of the SBOM to ensure it stays current.
- Depth: An SBOM should provide comprehensive details about software components and dependencies. As per NTIA, the minimum requirement is that developers list all top-level dependencies with enough detail.
- Known Unknowns: The author of the SBOM data should clearly state any components or dependencies that are unknown or have incomplete information.
- Distribution and Delivery: SBOMs should be readily available for users of software when needed for software transparency. Organizations can integrate SBOMs into the software development and delivery pipeline to ensure they are available at various software lifecycle stages.
- Access Control: Organizations that create and maintain open-source components find it best to make SBOM data public. However, those who want to restrict control to specific software users must specify control terms. They must also allow and accommodate customers who want to integrate their security tools with SBOM data.
- Accommodation of Mistakes: Even though SBOMs should, in actual sense, help prevent security errors and risks, NTIA acknowledges the fact that perfectionism doesn’t exist. Consumers of SBOMs should, therefore, be aware of this fact and allow for errors. However, organizations shouldn’t take advantage of this and intentionally ignore errors.
❗️The Importance of Software Bill of Materials (SBOM)
SBOM provides a comprehensive software inventory of all components used in an application. This transparency helps developers and stakeholders understand what makes up the software, including open-source libraries, third-party dependencies, and their respective versions. This then allows for identifying vulnerable or outdated components within the software stack easily and faster.
The software bill of materials also aids in verifying component origin and provenance. This is particularly important for ensuring the integrity of the software supply chain. For instance, the SolarWinds attack is a real-world example of why software transparency, facilitated by SBOMs, is crucial. In this attack, hackers tampered with the software supply chain to inject malicious code into SolarWinds’ software updates. As a result, many organizations unknowingly installed compromised software, leading to massive cybersecurity breaches.
In cases where long-term projects are involved, the software bill of materials can serve as a software blueprint. SBOMs make it easy for developers to understand and modify the software over time by providing a detailed record of its composition and dependencies. This can be especially valuable when a project spans years or even decades, and multiple development teams may come and go. A clear software bill of materials ensures that new developers can quickly get up to speed and understand the software’s architecture, reducing the risk of introducing errors or vulnerabilities during maintenance or updates.
Furthermore, the importance of software transparency through the software bill of materials extends to regulatory compliance and legal aspects. Many industries, such as healthcare, finance, and aerospace, have strict regulations and legal requirements governing the use of software. SBOMs can help organizations demonstrate compliance by providing a documented inventory of all application components and their licenses. This helps ensure that the software aligns with legal and regulatory standards.
⚙️ Automate Software Bill of Materials With Kiuwan
One of the essential elements of the software bill of materials is automation. Tools such as Kiuwan, our code security and code analysis platform, provide everything that is required for an SBOM, including the component name, version, and package ID. Sign up for a free trial today and one of our solutions engineers will give you pro-level insight or click the link below for a step-by-step demonstration on how to use Kiuwan to solve your SBOM needs.
