January 25, 2024 By C.J. Haughey 3 min read

The cost of cyberattacks on software supply chains is a growing problem, with the average data breach costing $4.45 million in 2023. Since President Biden’s 2021 executive order, software bills of materials (SBOMs) have become a cornerstone in protecting supply chains.

In December 2023, the National Security Agency (NSA) published new guidance to help organizations incorporate SBOMs and combat the threat of supply chain attacks.

Let’s look at how things have developed since Biden’s 2021 order and what these updates mean for the owners and operators of national security systems.

Navigating new standards: NIST and CISA’s contributions

Since 2021, the National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) have been pivotal in shaping SBOM standards. Their guidelines aim to offer companies and operators a complete picture of software components, including open-source software.

An SBOM should provide transparency into the ingredients of software, including:

  • Open-source libraries and dependencies
  • Commercial/proprietary libraries and modules
  • Services and tools
  • Versions of libraries and components
  • Relationships between components
  • Licensing information.

It’s important to collect and share this information in a clear format. There are three commonly-used standards for SBOMs:

  • Software Package Data Exchange (SPDX®): An open-source, machine-readable format developed by the Linux Foundation. SPDX is a flexible option with the size and capacity to be an all-inclusive format.
  • CycloneDX (CDX): An open-source, machine-readable format from the OWASP community. CDX is a more agile, user-friendly option than SPDX.
  • Software Identification (SWID): An ISO/IEC industry standard that many commercial software publishers use. This is, by far, the easiest standard to use — but its capabilities are limited to simple inventory and cataloging.

This standardization makes it easier for operators to understand and manage the security risks related to the software. Unfortunately, operators managing intricate tech stacks and cybersecurity systems often need to use more than one standard, which poses additional challenges.

What is supply chain management?

What are the problems with SBOMs?

SBOMs offer information about code provenance and help software engineering teams detect malicious attacks in their early stages — often during development and deployment. However, getting in line with the U.S. government’s regulations around SBOMs is not straightforward.

Here are some concerns:

  • Complex requirements: An app may comprise files, functions or code from separate third-party sources. Without proper documentation during development, creating an accurate SBOM that includes all components is challenging.
  • Lack of data: SBOMs explain the ingredients in software but share nothing about the quality of those components, the contributors or the processes around quality control.
  • Time investment: Companies must dedicate a lot of time to properly research and document SBOMs. Also, SBOMs are not static documents, so a new SBOM will be needed with every release or update — making this an ongoing draw on company resources.
  • Budget: With more time spent on SBOMs, compliance costs will impact the company’s payroll. Also, there’s a chance that SBOM focus can distract software developers from focusing on more serious security risks.
  • Intellectual property concerns: Sharing detailed software components can feel like giving away trade secrets. It’s a tightrope walk between optimal security and competitive positioning.

An imperfect step in the right direction

With the NSA’s latest updates for SBOM management, we can expect SBOMs to become a key aspect of securing and managing software supply chains in 2024. companies can use them to offer software developers and customers transparency about the software they use.

But it’s important to remember that SBOMs are not a magic bullet against cyberattacks on supply chains. Challenges in cost and compliance remain a concern, especially for smaller organizations.

Operators in national security and enterprises must adapt to the changes and collaborate with software developers to give companies the best chance of protecting their supply chains and assets.

Ready to take action? Learn how to secure your supply chain through cyber risk management.

More from Risk Management

Back to basics: Better security in the AI era

4 min read - The rise of artificial intelligence (AI), large language models (LLM) and IoT solutions has created a new security landscape. From generative AI tools that can be taught to create malicious code to the exploitation of connected devices as a way for attackers to move laterally across networks, enterprise IT teams find themselves constantly running to catch up. According to the Google Cloud Cybersecurity Forecast 2024 report, companies should anticipate a surge in attacks powered by generative AI tools and LLMs…

Mapping attacks on generative AI to business impact

5 min read - In recent months, we’ve seen government and business leaders put an increased focus on securing AI models. If generative AI is the next big platform to transform the services and functions on which society as a whole depends, ensuring that technology is trusted and secure must be businesses’ top priority. While generative AI adoption is in its nascent stages, we must establish effective strategies to secure it from the onset. The IBM Institute for Business Value found that despite 64%…

Ermac malware: The other side of the code

6 min read - When the Cerberus code was leaked in late 2020, IBM Trusteer researchers projected that a new Cerberus mutation was just a matter of time. Multiple actors used the leaked Cerberus code but without significant changes to the malware. However, the MalwareHunterTeam discovered a new variant of Cerberus — known as Ermac (also known as Hook) — in late September of 2022.To better understand the new version of Cerberus, we can attempt to shed light on the behind-the-scenes operations of the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today