Summary of "Hacking Humans" Podcast Episode: Software Bill of Materials (SBOM) Hosted by N2K Networks | Release Date: March 11, 2025

Introduction

In this episode of Hacking Humans, hosted by N2K Networks, the focus revolves around the concept of Software Bill of Materials (SBOM). SBOMs play a crucial role in enhancing cybersecurity by providing transparency into the components that constitute software products. This episode delves into the definition, significance, industry standards, and governmental mandates related to SBOMs, highlighting their impact on the future of software security.

Understanding SBOM

Nyla Genoi opens the discussion by clarifying the acronym SBOM:

“[01:34] Nyla Genoi: The word is SBOM, spelled S for software, B for bill and OM for of materials. A formal record containing the details and supply chain relationships of various components used in building software.”

She emphasizes that an SBOM is essentially a comprehensive inventory of all the components, including open-source libraries, embedded within a software product. This detailed documentation is vital for ensuring supply chain transparency and understanding the origin and context of each software component.

SBOM and Supply Chain Transparency

Genoi highlights the pervasive use of open-source components in software development:

“[01:34] Nyla Genoi: According to Forrester Sandy Corelli, on average, 75% of a software product is open source code, meaning developers are using existing commercially available software components to create new products.”

This reliance on open-source code introduces significant cybersecurity risks. Without a clear understanding of the nested software components, organizations may unknowingly incorporate compromised or vulnerable elements into their products. SBOMs address this issue by providing visibility into the software's composition, enabling better risk management and mitigation strategies.

Industry Standards and SPDX

The episode details the evolution of SBOM standards, particularly the role of the Software Package Data Exchange (SPDX):

“[01:34] Nyla Genoi: On September 9, 2021, the software package Data Exchange specification SPDX for short, became the international open standard for security, license compliance and other software supply chain artifacts.”

SPDX serves as the official standard for SBOMs, adopted by major corporations like Intel, Microsoft, Sony, and VMware. The standardization was the result of a decade-long collaboration among vendors in the Software Composition Analysis (SCA) space, which focuses on assessing open-source code libraries and containers to identify and remediate risks.

Genoi points out that while SCA tools have historically been niche, their importance is escalating:

“[01:34] Nyla Genoi: These are vendor tools that assess open source software code libraries and containers to provide a unified view of risks and remediations and offer strategies to keep this kind of software up to date.”

Government Mandates and Influence

A significant portion of the episode is dedicated to exploring the impact of President Joe Biden's Executive Order on Cybersecurity (EO1402A):

“[05:37] Joe Biden: Last night I signed an Executive Order to improve the nation's cybersecurity. It calls for federal agencies to work more closely with the private sector to share information, strengthen cybersecurity practices, and deploy technologies that increase reliance against cyber attacks. It outlines innovative ways the government will drive to deliver security in software using federal buying power to jumpstart the market and improve the products that all Americans use.”

This executive order mandates that all federal civilian executive branch agencies, along with key organizations like CISA, OMB, DHS, and the DoD, comply with specific cybersecurity requirements, including the deployment of SBOM programs by spring 2022. Consequently, vendors aiming to secure federal contracts must provide SBOM telemetry, positioning SBOMs as a competitive advantage in the commercial software market.

Genoi explains the broader implications:

“[01:34] Nyla Genoi: If this works out, the Presidential directive could fast track sbombs to an existing standard of protection against supply chain vulnerabilities.”

By enforcing SBOM requirements, the government is accelerating the adoption of standardized security practices, thereby enhancing the overall resilience of the software supply chain against cyber threats.

Future Implications of SBOM

The adoption of SBOMs is poised to transform the landscape of software development and cybersecurity:

• Market Differentiation: Vendors providing comprehensive SBOMs will stand out in the marketplace, attracting customers who prioritize security and transparency.

• Enhanced Risk Management: Organizations will be better equipped to identify and address vulnerabilities within their software, reducing the likelihood of breaches and cyber attacks.

• Standardization and Compliance: As SBOMs become standardized, they will simplify compliance with regulatory requirements and facilitate smoother interactions between different entities within the software supply chain.

Conclusion

This episode of Hacking Humans effectively underscores the pivotal role of SBOMs in modern cybersecurity. By detailing the definition, significance, industry standards, and governmental mandates surrounding SBOMs, the podcast highlights how these tools are integral to safeguarding software supply chains against increasingly sophisticated cyber threats. As SBOM adoption becomes more widespread, it is set to become a cornerstone of secure software development practices.

Notable Quotes:

• Nyla Genoi [01:34]:

  "The word is SBOM, spelled S for software, B for bill and OM for of materials. A formal record containing the details and supply chain relationships of various components used in building software."

• Joe Biden [05:37]:

  "Last night I signed an Executive Order to improve the nation's cybersecurity. It calls for federal agencies to work more closely with the private sector to share information, strengthen cybersecurity practices, and deploy technologies that increase reliance against cyber attacks."

This comprehensive summary captures the essence of the episode, providing insights into SBOMs' critical role in enhancing cybersecurity and ensuring supply chain transparency. Whether you're a cybersecurity professional or someone interested in the intricacies of software security, this episode offers valuable perspectives on the evolving landscape of cyber defense.