July 11, 2024
Everyone likes to hit the “Easy” button, especially software developers. Rather than laboriously generate code line-by-line, today’s software professionals may just grab code from a repository and re-purpose it. Why reinvent the wheel?
Malicious actors have noticed this process and have inserted code into many libraries, acting like a like Trojan Horse. As a result, some organizations are offering codes that have been inspected. They look at known vulnerability lists and see if the code includes any of them. If not, it is given a seal of approval.
Frequently, this is called a “Software Bill of Materials.” A convenient solution: however, upon inspection, SBOMs can be problematic.
The weakness of SBOM
During today’s interview, Joel Krooswyk, Federal CTO for Gitlab, described in detail some of the ways software must be continuously protected.
According to the SBOM folks, the code is clean when leaves the “shelf.” However, due to continuous improvement code changes hourly. All an SBOM provides is a certification at a specific point in time for known vulnerabilities.
Joel Krooswyk gives listeners an enterprise architect’s perspective. He indicates that digital transition introduces new code, new architectures, and innovative approaches. At any step along the way, security can be compromised.
"What I like to focus on is the dynamic component of SBOM. What happens the next day when an emergent threat just appears on the scene? From a Gitlab perspective, we are looking at what an SBOM can be over time"
The unknown unknown
Donald Rumsfeld famously said, “There are unknown unknowns.” This can be directly applied to what Gitlab calls “fuzz” testing. This allows professionals to throw random inputs into a system to see what happens. Finally, you get a view of a potential possibilities that are not obvious.
Joel Krooswyk presents many insights when it comes to protecting software. He states that just because a system is identified as needing a patch, it does not mean it will be done in a flash.
Understanding all the risk factors will allow a federal leader to make a prudent choice when it comes to protecting software systems.
If you enjoyed this episode, then you may want to listen to
EP 165 – The Role of Strategy in Federal Cybersecurity
Why: Provides a broader strategic context for secure software initiatives across federal agencies.EP 159 – What Is Proactive Cybersecurity?
Why: Highlights a forward-thinking approach to security that complements SBOM discussions
Good insights regarding SBOM and Vulnerability disclosure reporting. Well done, Joel.