Скачать или смотреть Supply Chain Risk Management: Creating a Software Bill of Materials (SBOM) for Security

Supply Chain Risk Management: Creating a Software Bill of Materials (SBOM) for Security


The software supply chain is now the number one attack vector for major breaches (e.g., SolarWinds, Log4j). If you're using third-party libraries, open-source components, or external APIs, you need to know exactly what’s running inside your applications.

This video is an essential guide to Software Bill of Materials (SBOM)—what it is, why it's a mandatory security control, and how to start generating one effectively. We break down the practical steps needed to gain visibility and control over your software dependencies.

In This Practical Guide for DevSecOps and CISOs, You Will Learn:
What is an SBOM? A clear, concise explanation of the SBOM's role as a complete, formal inventory of all components, libraries, and modules used in a piece of software.

The Regulatory Push: Understanding why governments (like the U.S. Executive Order on Cybersecurity) and industry bodies are making SBOMs a mandatory requirement for security compliance.

Generating Your First SBOM: A hands-on look at popular open-source and commercial tools (Syft, CycloneDX, SPDX) for scanning codebases and generating accurate, standardized SBOMs.

Analyzing Vulnerabilities: How to ingest your SBOM into vulnerability scanning tools to automatically detect and prioritize risks associated with known third-party flaws (e.g., using the data to find Log4j instances).

Integrating into CI/CD: Strategies for embedding SBOM generation into your existing Continuous Integration/Continuous Delivery (CI/CD) pipeline to ensure continuous compliance.

Managing Third-Party Risk (TPRM): How to request, analyze, and store SBOMs provided by your software vendors to manage their inherent security risk.

This video is a must-watch for DevSecOps teams, Software Architects, Security Engineers, and Risk Managers focused on mitigating supply chain and third-party security threats.

Key Concepts & Standards:
Software Bill of Materials (SBOM)

Supply Chain Attack

Vulnerability Management

CycloneDX and SPDX Formats

CI/CD Integration

Third-Party Risk Management (TPRM)


#SBOM #SupplyChainSecurity #DevSecOps #VulnerabilityManagement #CybersecurityRisk #Log4j #SoftwareSecurity #SPDX #CycloneDX

Viewer Question: Are you currently generating SBOMs for your applications? What tool are you finding most effective for accuracy? Let us know in the comments! 👇