What the heck is a Software Bill of Materials?

In this episode, Matt uses the analogy of America’s beloved boxed mac n’ cheese to define what a software bill of materials (SBOM) is and should be. He then points out that when making SBOMs, organizations should look to approved and standardized SBOM formats for them to be as clear and transparent as possible.

Keep learning
• Podcast: Don't Sleep on SBOMS
• Report: Why NIST is Driving SBOM Evolution
• Special: The State of Supply Chain Security

Episode Transcript

MATT ROSE: Hi everyone. Welcome back to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs. Today's episode is called WTF is an SBOM? SBOM (software bill of materials) is one of the hottest topics in the industry these days. Everybody's talking about SBOMs. It's even going to the highest level of government with the President in the Executive Order about SBOMs, self attestation of what's in your software.

But not all SBOMs are created equal. I'm gonna use a visual here just to help everybody out. So really what I think an SBOM is a ingredients list, like food products. Who doesn't love Kraft mac and cheese? Kraft mac and cheese been around forever. Staple of every kid's diet. But again, who doesn't love powdered cheese?

The thing about an ingredients list is it needs to include everything in that box. So if  you're looking at a lot of the SBOMs that competitors or companies are creating, they're just providing an SBOM of the mac, not the cheese. What if you're allergic to cheese or wheat or gluten or whatever it is in there?

You need to know all the ingredients... that extrapolates and maps directly to a software bill of materials for an application or a piece of software. So, SCA, other vendors that are producing a component, just the open source code, just the homegrown code, just the APIs as a bill of materials.

That's only a piece. That's just the mac, but not the cheese. So we'll get rid of our little graphic here and our favorite mac and cheese lunch as a kid, to think about what is a proper SBOM. A proper SBOM has to be comprehensive for the entire piece of software, the entire application. And there's really three major formats or approved formats that are people are looking to provide an SBOM in a consistent format or a consistent way.

We have Cyclone DX from OWAST. We have SPDX and SPDX Light from the Linux Foundation. And then we have SWID from, where are they from? NIST, sorry, little bit of a brain cramp there. These are appropriate formats of an SBOM. They basically are consistent, they're repeatable, and they basically don't leave anything to the imagination.