Uncovering Hidden Risks in Your Software: The Power of SBOMs

Bill of Material (BOM) is an accounting term that describes the record of the raw materials, sub-assemblies, and supplies used to construct a product. It serves as a guide for production and is also used for inventory management, cost estimating, and engineering change management.

Similarly, a Software Bill of Material (SBOM) lists all the components and dependencies required to build and deploy a software application. It includes information such as the version number, license, and source code repository for each element. Software developers use the SBOM to manage the software development process and to ensure that all necessary components are included in the final product. It also plays a vital role in software security by identifying potential vulnerabilities in the components used in the application. Finally, it also helps ensure compliance with any applicable legal or regulatory requirements related to software.

The rising use of third-party and open-source software in modern applications drives the need for SBOMs. These components often have vulnerabilities and security risks, making it difficult for organizations to track and manage them effectively without an SBOM.

The SolarWinds cyber-attack, discovered in December 2020, is a prime example of how adversaries exploited open-source software vulnerabilities to devastating effect. The attack targeted multiple government agencies, including the U.S. Treasury and Commerce departments and private sector companies.

The adversaries used a supply chain attack to compromise SolarWinds, a Texas-based software company that provides I.T. management and monitoring tools to government agencies and private companies. They then used the software updates from SolarWinds to distribute malware to the company's customers, allowing them to gain access to the networks of the target organizations.

The attack was notable for its scale, as well as its level of sophistication. The adversaries were able to evade detection for several months while they gathered information and exfiltrated data from the networks of the target organizations. The attack has resulted in heightened awareness of the importance of supply chain security and the need for organizations to have a software bill of materials (SBOM) and to track third-party software components for vulnerabilities.

The Cybersecurity Executive Order 14028, signed by President Joe Biden on January 26, 2021, is focused on strengthening the federal government's cybersecurity and its networks and includes a focus on the Software Bill of Materials (SBOM). The goal is to improve software vendors' transparency and accountability and enhance organizations' ability to identify and mitigate vulnerabilities in the software they use.

The order directs the Cybersecurity and Infrastructure Security Agency (CISA) to develop guidelines for creating and using SBOMs and to work with the private sector to encourage the use of SBOMs in software development. Additionally, it directs federal agencies to assess the use of SBOMs in their software development processes and consider using SBOMs as a requirement when procuring software.

An SBOM serves as a comprehensive inventory of the software's components and provides insight into the software's composition and any vulnerabilities that may exist. SBOMs have become increasingly prevalent in recent years as organizations look to improve software vendors' transparency and accountability while enhancing their ability to identify and mitigate vulnerabilities in the software they use. In this write-up, we explore the advantages and disadvantages of SBOMs and their impact on software security.

One of the main advantages of SBOMs is that they provide organizations with a clear understanding of the software they are using. By having a comprehensive inventory of the software's components and versions, organizations can more easily identify any vulnerabilities in the software. This vulnerability information is essential for critical infrastructure systems and other high-risk applications, where even a single exposure can have severe consequences. With an SBOM, organizations can quickly identify and address vulnerabilities, reducing the risk of a successful cyber attack.

SBOMs also provide organizations with greater transparency and accountability regarding software vendors. Enabling organizations to access detailed information about the software's components can help better understand the software's composition and associated risks.

Organizations can use this information to evaluate software vendors' security practices and make more informed decisions about which vendors to partner with. Additionally, SBOMs can be used to track software development over time, which can help organizations identify when a vendor has made changes that could impact the software's security.

Another advantage of SBOMs is that they can help organizations automate their vulnerability management processes. Organizations can more easily identify and prioritize vulnerabilities by having a detailed inventory of the software's components. This information can help organizations manage their vulnerability remediation efforts more efficiently, reducing the risk of a successful cyber attack. Additionally, SBOMs can integrate with other security tools, such as vulnerability scanners, to automate the detection and remediation of vulnerabilities.

Despite the many advantages of SBOMs, there are also some potential disadvantages. One of the main disadvantages is that creating and maintaining an SBOM can be time-consuming and resource-intensive. This task is particularly true for large and complex software systems with hundreds or even thousands of components. Additionally, SBOMs can be challenging to maintain over time as software components are updated, replaced, or removed.

Another potential disadvantage is that SBOMs may only sometimes be accurate or complete. Software vendors may only sometimes provide complete information about their software components, or the information may need to be more accurate. Incomplete information can make it difficult for organizations to fully understand the software's composition and vulnerabilities. Additionally, SBOMs may only sometimes include information about third-party components in the software, making it difficult for organizations to identify and address vulnerabilities in these components.

In addition, SBOMs can be a target for attackers themselves, as they provide a detailed map of the software's components and vulnerabilities. Attackers can use this information to identify the most critical vulnerabilities to exploit and use the SBOMs to develop more effective attack methods. Furthermore, SBOMs may also contain sensitive information about the software and its vulnerabilities, which attackers can exploit if they can access the SBOM.

Finally, there is also the issue of standardization regarding SBOMs. Because SBOMs are a relatively new concept, there currently needs to be a standard format for SBOMs, which can make it difficult for organizations to use them effectively. Additionally, software vendors may use different formats for their SBOMs, complicating the process of comprehending their information.

SBOMs can be an effective tool for organizations to improve the security of their software and manage the risks associated with software supply chains. Organizations that take the time to implement SBOMs in a comprehensive and standardized way will be well-positioned to improve the security of their software and protect their systems and customers from emerging cyber threats.

References:

• Bill of materials definition — AccountingTools.
• Executive Order on Improving the Nation's Cybersecurity
• The Minimum Elements For a Software Bill of Materials (SBOM)