Updated SBOM guidance: A new era for software transparency?

Authors

C.J. Haughey

Tech Writer

The cost of cyberattacks on software supply chains is a growing problem, with the average data breach costing USD 4.45 million in 2023. Since President Biden’s 2021 executive order, software bills of materials (SBOMs) have become a cornerstone in protecting supply chains.

In December 2023, the National Security Agency (NSA) published new guidance to help organizations incorporate SBOMs and combat the threat of supply chain attacks.

Let’s look at how things have developed since Biden’s 2021 order and what these updates mean for the owners and operators of national security systems.

Navigating new standards: NIST and CISA’s contributions

Since 2021, the National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) have been pivotal in shaping SBOM standards. Their guidelines aim to offer companies and operators a complete picture of software components, including open-source software.

An SBOM should provide transparency into the ingredients of software, including:

Open-source libraries and dependencies
Commercial/proprietary libraries and modules
Services and tools
Versions of libraries and components
Relationships between components
Licensing information.

It’s important to collect and share this information in a clear format. There are three commonly-used standards for SBOMs:

Software Package Data Exchange (SPDX®): An open-source, machine-readable format developed by the Linux Foundation. SPDX is a flexible option with the size and capacity to be an all-inclusive format.
CycloneDX (CDX): An open-source, machine-readable format from the OWASP community. CDX is a more agile, user-friendly option than SPDX.
Software Identification (SWID): An ISO/IEC industry standard that many commercial software publishers use. This is, by far, the easiest standard to use — but its capabilities are limited to simple inventory and cataloging.

This standardization makes it easier for operators to understand and manage the security risks related to the software. Unfortunately, operators managing intricate tech stacks and cybersecurity systems often need to use more than one standard, which poses additional challenges.

What is supply chain management?

Industry newsletter

The latest tech news, backed by expert insights

Stay up to date on the most important—and intriguing—industry trends on AI, automation, data and beyond with the Think newsletter. See the IBM Privacy Statement.

What are the problems with SBOMs?

SBOMs offer information about code provenance and help software engineering teams detect malicious attacks in their early stages — often during development and deployment. However, getting in line with the U.S. government’s regulations around SBOMs is not straightforward.

Here are some concerns:

Complex requirements: An app may comprise files, functions or code from separate third-party sources. Without proper documentation during development, creating an accurate SBOM that includes all components is challenging.
Lack of data: SBOMs explain the ingredients in software but share nothing about the quality of those components, the contributors or the processes around quality control.
Time investment: Companies must dedicate a lot of time to properly research and document SBOMs. Also, SBOMs are not static documents, so a new SBOM will be needed with every release or update — making this an ongoing draw on company resources.
Budget: With more time spent on SBOMs, compliance costs will impact the company’s payroll. Also, there’s a chance that SBOM focus can distract software developers from focusing on more serious security risks.
Intellectual property concerns: Sharing detailed software components can feel like giving away trade secrets. It’s a tightrope walk between optimal security and competitive positioning.

Mixture of Experts | 25 April, episode 52

Decoding AI: Weekly News Roundup

Join our world-class panel of engineers, researchers, product leaders and more as they cut through the AI noise to bring you the latest in AI news and insights.

Watch the latest podcast episodes

An imperfect step in the right direction

With the NSA’s latest updates for SBOM management, we can expect SBOMs to become a key aspect of securing and managing software supply chains in 2024. companies can use them to offer software developers and customers transparency about the software they use.

But it’s important to remember that SBOMs are not a magic bullet against cyberattacks on supply chains. Challenges in cost and compliance remain a concern, especially for smaller organizations.

Operators in national security and enterprises must adapt to the changes and collaborate with software developers to give companies the best chance of protecting their supply chains and assets.

Ready to take action? Learn how to secure your supply chain through cyber risk management.