CyberWire Daily Podcast Summary
Episode: Software Bill of Materials (SBOM)
Host/Author: N2K Networks
Release Date: March 11, 2025

Introduction to SBOM

In this episode of CyberWire Daily, hosted by N2K Networks, cybersecurity expert Nyla Genoi delves into the critical topic of the Software Bill of Materials (SBOM). SBOMs are emerging as essential tools for enhancing software supply chain transparency and managing cybersecurity risks in an increasingly interconnected digital landscape.

Understanding SBOM

Nyla Genoi begins by defining SBOMs, stating, “The word is SBOM, spelled S for software, B for bill and OM for of materials” (01:34). An SBOM is a comprehensive record detailing the various components and their supply chain relationships used in building software. Genoi emphasizes that SBOMs are essentially “lists of nested software components designed to enable supply chain transparency, origin and context” (01:34).

Importance of SBOMs in Cybersecurity

Genoi highlights the significance of SBOMs within the NIST Cybersecurity Framework, noting that "if an organization does not know what its software contains, it should assume that the software is compromised and develop an appropriate risk management plan" (01:34). This underscores the necessity for organizations to have visibility into the components that constitute their software to effectively mitigate potential security threats.

Prevalence of Open Source in Software Development

Addressing the modern software development paradigm, Genoi cites Forrester’s Sandy Corelli, revealing that “on average, 75% of a software product is open source code” (01:34). This reliance on open source components introduces significant cybersecurity risks, as the intricate nesting of software elements can obscure vulnerabilities and complicate risk management for customers who receive these compounded software products.

SBOM Standards and Adoption

The episode proceeds to discuss the establishment of SBOM standards, particularly the Software Package Data Exchange (SPDX). Genoi explains that on September 9, 2021, SPDX became the international open standard for SBOMs, gaining recognition from industry giants like Intel, Microsoft, Sony, and VMware (01:34). This standardization is crucial for enabling consistent communication and utilization of SBOM information across various platforms and organizations.

Evolution of Software Composition Analysis (SCA) Tools

Genoi traces the evolution of SBOMs to a decade of collaboration within the Software Composition Analysis (SCA) space. These tools assess open source libraries and containers, providing unified views of associated risks and remediation strategies. Despite their advanced capabilities, SCA tools have historically been niche, catering to specific software development needs. However, this trend is shifting as the importance of supply chain security gains prominence.

Impact of Government Mandates on SBOM Adoption

A pivotal moment for SBOM adoption, as discussed by Genoi, was President Joe Biden's May 2021 Executive Order on Cybersecurity (EO1402A). This directive mandates that all federal civilian executive branch agencies, along with key players like CISA, OMB, DHS, and the DoD, meet stringent cybersecurity requirements by deploying SBOM programs by spring 2022 (01:34). Genoi suggests that this government mandate is likely to accelerate SBOM adoption among vendors, as compliance becomes a competitive differentiator in the commercial sector. She posits, “Why would you pick a vendor who doesn't provide SBOM telemetry when other vendors are available who do?” (01:34).

Presidential Support and Future Outlook

Highlighting the broader governmental support for SBOMs, the podcast features a clip of President Joe Biden at 05:37, stating:

“Last night I signed an Executive Order to improve the nation's cybersecurity. It calls for federal agencies to work more closely with the private sector to share information, strengthen cybersecurity practices, and deploy technologies that increase reliance against cyber attacks.”

Biden further elaborates on leveraging federal buying power to enhance software security, indicating a strong governmental push towards making SBOMs a standard practice for safeguarding software supply chains.

Conclusion

In conclusion, Nyla Genoi underscores the transformative potential of SBOMs in fortifying cybersecurity frameworks. With increasing reliance on open source components and escalating cyber threats, SBOMs emerge as indispensable tools for ensuring software integrity and resilience. The episode effectively conveys the urgency for widespread SBOM adoption, driven by both industry standards and governmental mandates, positioning SBOMs as a cornerstone of modern cybersecurity strategy.

Notable Quotes:

• Nyla Genoi (01:34): “SBOMs are lists of nested software components designed to enable supply chain transparency, origin and context.”

• Nyla Genoi (01:34): “Why would you pick a vendor who doesn't provide SBOM telemetry when other vendors are available who do?”

• President Joe Biden (05:37): “It calls for federal agencies to work more closely with the private sector to share information, strengthen cybersecurity practices, and deploy technologies that increase reliance against cyber attacks.”

For more insights and detailed discussions on cybersecurity, subscribe to CyberWire Daily by N2K Networks.