June 27, 2024
Years ago, people would laboriously code character by character. This tedious process would take hours and would include errors. Over the years, libraries of prewritten code have evolved that allow software developers to “grab” some code, modify it, and finish a project earlier.
Malicious actors have taken advantage of this short cut and have injected code into these software libraries that get taken along for the ride.
One proposed solution is something borrowed from the shipping industry. A commercial invoice may be packaged with a bill of lading to indicate the contents of the package. This “assurance” has been transferred to the world of pre-written code and is now called a “Software Bill of Materials,” or SBOM.
In a world where you are shipping a ton of Portland Type II cement overseas, this bill of lading works finds; it has some challenges being transferred to the dynamic world of software.
"as you alluded to, that opens up other vulnerabilities, right, you may want that one function out of that code, but you have other things that are disabled . . .or could provide backdoors . . . "
In a typical federal environment, there is continuous change in the code itself. It would be difficult to change on ton of a manufactured product like Portland Type II cement. However, the once approved software package may have so many changes that the Software Bill of Materials may not have any validity.
During the interview today, David Jurkiewicz unpacks the concept of an initial SBOM and then how software packages can evolve over time and still retain compliance. His company can take this basic guarantee and examine the software for many concerns, including.
- Vulnerabilities
- Dependencies
- Integrity
- Malware
- Foreign presence
- License
David Jurkiewicz provides details on how companies can resolve vulnerabilities and ensure safe operations in a world where code is grabbed off the shelf and slipped into a package.
If you enjoyed this episode, then you may want to listen to
EP-163: Beyond the SBOM for Secure Software Development
Why: Directly builds on the SBOM conversation by covering what comes after its implementation in secure development practices.EP-165: The Role of Strategy in Federal Cybersecurity
Why: Discusses how strategic frameworks—including SBOM—play into long-term cybersecurity efforts in federal systems
Leave a Reply