January 25, 2024 By C.J. Haughey 3 min read

The cost of cyberattacks on software supply chains is a growing problem, with the average data breach costing $4.45 million in 2023. Since President Biden’s 2021 executive order, software bills of materials (SBOMs) have become a cornerstone in protecting supply chains.

In December 2023, the National Security Agency (NSA) published new guidance to help organizations incorporate SBOMs and combat the threat of supply chain attacks.

Let’s look at how things have developed since Biden’s 2021 order and what these updates mean for the owners and operators of national security systems.

Navigating new standards: NIST and CISA’s contributions

Since 2021, the National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) have been pivotal in shaping SBOM standards. Their guidelines aim to offer companies and operators a complete picture of software components, including open-source software.

An SBOM should provide transparency into the ingredients of software, including:

  • Open-source libraries and dependencies
  • Commercial/proprietary libraries and modules
  • Services and tools
  • Versions of libraries and components
  • Relationships between components
  • Licensing information.

It’s important to collect and share this information in a clear format. There are three commonly-used standards for SBOMs:

  • Software Package Data Exchange (SPDX®): An open-source, machine-readable format developed by the Linux Foundation. SPDX is a flexible option with the size and capacity to be an all-inclusive format.
  • CycloneDX (CDX): An open-source, machine-readable format from the OWASP community. CDX is a more agile, user-friendly option than SPDX.
  • Software Identification (SWID): An ISO/IEC industry standard that many commercial software publishers use. This is, by far, the easiest standard to use — but its capabilities are limited to simple inventory and cataloging.

This standardization makes it easier for operators to understand and manage the security risks related to the software. Unfortunately, operators managing intricate tech stacks and cybersecurity systems often need to use more than one standard, which poses additional challenges.

What is supply chain management?

What are the problems with SBOMs?

SBOMs offer information about code provenance and help software engineering teams detect malicious attacks in their early stages — often during development and deployment. However, getting in line with the U.S. government’s regulations around SBOMs is not straightforward.

Here are some concerns:

  • Complex requirements: An app may comprise files, functions or code from separate third-party sources. Without proper documentation during development, creating an accurate SBOM that includes all components is challenging.
  • Lack of data: SBOMs explain the ingredients in software but share nothing about the quality of those components, the contributors or the processes around quality control.
  • Time investment: Companies must dedicate a lot of time to properly research and document SBOMs. Also, SBOMs are not static documents, so a new SBOM will be needed with every release or update — making this an ongoing draw on company resources.
  • Budget: With more time spent on SBOMs, compliance costs will impact the company’s payroll. Also, there’s a chance that SBOM focus can distract software developers from focusing on more serious security risks.
  • Intellectual property concerns: Sharing detailed software components can feel like giving away trade secrets. It’s a tightrope walk between optimal security and competitive positioning.

An imperfect step in the right direction

With the NSA’s latest updates for SBOM management, we can expect SBOMs to become a key aspect of securing and managing software supply chains in 2024. companies can use them to offer software developers and customers transparency about the software they use.

But it’s important to remember that SBOMs are not a magic bullet against cyberattacks on supply chains. Challenges in cost and compliance remain a concern, especially for smaller organizations.

Operators in national security and enterprises must adapt to the changes and collaborate with software developers to give companies the best chance of protecting their supply chains and assets.

Ready to take action? Learn how to secure your supply chain through cyber risk management.

More from Risk Management

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today