Software supply chain explained

A software supply chain is composed of the components, libraries, tools, and processes used to develop, build, and publish a software artifact.[1]

Software vendors often create products by assembling open source and proprietary software components. A software bill of materials[2] (SBOM) declares the inventory of components used to build a software artifact such as a software application.[3] It is analogous to a list of ingredients on food packaging: where you might consult a label to avoid foods that may cause allergies, SBOMs can help organizations or persons avoid consumption of software that could harm them.

The concept of a BOM is well-established in traditional manufacturing as part of supply chain management.[4] A manufacturer uses a BOM to track the parts it uses to create a product. If defects are later found in a specific part, the BOM makes it easy to locate affected products.

Usage

An SBOM is useful both to the builder (manufacturer) and the buyer (customer) of a software product. Builders often leverage available open-source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities.[5] Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product.

While many companies just use a spreadsheet for general BOM management, there are additional risks and issues in an SBOM written to a spreadsheet. SBOMs gain greater value when collectively stored in a repository that can be a part of other automation systems, easily queried by other applications. This need for automated SBOM processing is addressed by various software vendors, especially those making use of open document standards.

Understanding the supply chain of software, obtaining an SBOM, and using it to analyze known vulnerabilities are crucial in managing risk.[6] [7] [8]

Legislation

The Cyber Supply Chain Management and Transparency Act of 2014[9] was US legislation that proposed to require government agencies to obtain SBOMs for any new products they purchase. It also would have required obtaining SBOMs for "any software, firmware, or product in use by the United States Government". Though it ultimately didn't pass, this act did bring awareness to government and spurred later legislation such as "Internet of Things Cybersecurity Improvement Act of 2017."[10] [11]

The US Executive Order on Improving the Nation’s Cybersecurity of May 12, 2021[12] ordered NIST to issue guidance within 90 days to "include standards, procedures, or criteria regarding" several topics in order to "enhance the security of the software supply chain," including "providing a purchaser a Software Bill of Materials (SBOM) for each product." Also mandated within 60 days was for NTIA to "publish minimum elements for an SBOM."

The NTIA minimum elements were published on July 12, 2021,[13] and also "describes SBOM use cases for greater transparency in the software supply chain, and lays out options for future evolution." The minimum elements consist of three broad categories: data fields (baseline information about each software component), automation support (the ability to generate SBOMs in machine- and human-readable formats), and practices and processes (how and when organizations should generate SBOMs). The "automation support" requirement specifies the need for "automatic generation," which is possible with the use of Software Composition Analysis (SCA) solutions.[14]

See also

Notes and References

  1. Web site: For Good Measure Counting Broken Links: A Quant's View of Software Supply Chain Security . USENIX ;login . 2022-07-04 . 2022-12-17 . https://web.archive.org/web/20221217223413/https://www.usenix.org/system/files/login/articles/login_winter20_17_geer.pdf . live .
  2. Web site: Software Bill of Materials . ntia.gov . 2021-01-25 . 2022-11-30 . https://web.archive.org/web/20221130122348/https://www.ntia.gov/SBOM . live .
  3. Web site: [Part 2] Code, Cars, and Congress: A Time for Cyber Supply Chain Management ]. 2015-06-12 . 2015-06-14 . https://web.archive.org/web/20150614155320/http://blog.sonatype.com/2014/12/cyber-supply-chain-management-part2/ . dead .
  4. Web site: Code, Cars, and Congress: A Time for Cyber Supply Chain Management . 2015-06-12 . 2014-12-30 . https://web.archive.org/web/20141230024245/http://blog.sonatype.com/2014/12/cyber-supply-chain-management-part1/ . dead .
  5. Web site: Software Bill of Materials improves Intellectual Property management . Embedded Computing Design . 2015-06-12 . 2018-08-25 . https://web.archive.org/web/20180825115542/http://embedded-computing.com/article-id/?3826= . live .
  6. Web site: Appropriate Software Security Control Types for Third Party Service and Product Providers . Docs.ismgcorp.com . 2015-06-12 . 2023-01-19 . https://web.archive.org/web/20230119154913/http://docs.ismgcorp.com/files/external/WP_FSISAC_Third_Party_Software_Security_Working_Group.pdf . live .
  7. Web site: Top 10 2013-A9-Using Components with Known Vulnerabilities . 2015-06-12 . 2019-10-06 . https://web.archive.org/web/20191006034721/https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities . live .
  8. Web site: Cyber-security risks in the supply chain . PDF . Cert.gov.uk . 2020-07-28 . 2023-06-06 . https://web.archive.org/web/20230606054804/https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security . live .
  9. Web site: H.R.5793 - 113th Congress (2013-2014): Cyber Supply Chain Management and Transparency Act of 2014 - Congress.gov - Library of Congress. 4 December 2014. 2015-06-12. 2022-12-16. https://web.archive.org/web/20221216085631/https://www.congress.gov/bill/113th-congress/house-bill/5793. live.
  10. Web site: Internet of Things Cybersecurity Improvement Act of 2017 . 2020-02-26 . 2023-01-19 . https://web.archive.org/web/20230119154917/https://www.warner.senate.gov/public/_cache/files/8/6/861d66b8-93bf-4c93-84d0-6bea67235047/8061BCEEBF4300EC702B4E894247D0E0.iot-cybesecurity-improvement-act---fact-sheet.pdf . live .
  11. Web site: Cybersecurity Improvement Act of 2017: The Ghost of Congress Past . 17 August 2017 . 2020-02-26 . 2022-12-16 . https://web.archive.org/web/20221216085645/https://devops.com/cybersecurity-improvement-act-2017-ghost-congress-past/ . live .
  12. Web site: 2021-05-12. Executive Order on Improving the Nation's Cybersecurity. 2021-06-12. The White House. en-US. 2021-05-15. https://web.archive.org/web/20210515153804/https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/. live.
  13. Web site: 2021-07-12. The Minimum Elements For a Software Bill of Materials (SBOM). 2021-12-12. NTIA.gov. en-US. 2023-06-05. https://web.archive.org/web/20230605180225/https://www.ntia.doc.gov/report/2021/minimum-elements-software-bill-materials-sbom. live.
  14. Web site: 2021-07-12. NTIA Releases Minimum Elements for a Software Bill of Materials. 2022-03-22. NTIA.gov. en-US. 2022-11-22. https://web.archive.org/web/20221122233746/https://www.ntia.doc.gov/blog/2021/ntia-releases-minimum-elements-software-bill-materials. live.

This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "Software supply chain".

Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2024, A B Cryer, All Rights Reserved. Cookie policy.