{"id":103,"date":"2023-03-07T07:25:00","date_gmt":"2023-03-07T07:25:00","guid":{"rendered":"https:\/\/cloudtechner.com\/blog\/?p=103"},"modified":"2024-06-13T11:05:21","modified_gmt":"2024-06-13T11:05:21","slug":"sbom-a-way-to-increase-security-transparency-visibility-into-software-supply-chain","status":"publish","type":"post","link":"https:\/\/cloudtechner.com\/blog\/sbom-a-way-to-increase-security-transparency-visibility-into-software-supply-chain\/","title":{"rendered":"SBOM \u2014 A Way to increase Security, Transparency & Visibility into Software Supply chain"},"content":{"rendered":"\n

Author: Sandeep Bajpai<\/a>, Senior Architect<\/p>\n\n\n

Modernization<\/a>, <\/span>SBOM<\/a>, <\/span>Software Bill of Material<\/a>, <\/span>Software Inventory<\/a>, <\/span>Software Licenses<\/a>, <\/span>Software Supply Chain<\/a><\/div>\n\n\n
\n\n\n\n

\u201c SBOM \u2014 What\u2019s that ? \u201c Don\u2019t worry its not A bomb or A soft bomb \ud83d\ude03\u201d<\/strong><\/p>\n\n\n\n

\"\"\/
SBOM<\/figcaption><\/figure>\n\n\n\n

SBOM stands for Software Bill of Materials<\/strong>. It is a comprehensive inventory of all the components and dependencies that make up a software product. It is essentially a list of all the software components, libraries, and dependencies used in creating a software product, along with their respective versions, license information, and other relevant metadata.<\/p>\n\n\n\n

\u201cLets Understand with An Example\u201d<\/em><\/strong><\/p>\n\n\n\n

A Seasoned Project Manager and Technical Architect decided to start building a software product , They created a Team of developers and asked them to develop a module of the product. Development Team starts developing the module and soon they realise that they would need some open source or licensed libraries to be integrated or imported for completing the module functionality. They used the open source modules , packaged and deployed on the test environment. Technical Architect was reviewing the code and identified few lines codes from two different developers<\/p>\n\n\n\n

Developer -1 Code:<\/p>\n\n\n\n

import random

# generate a random number between 1 and 10
random_number = random.randint(1, 10)

# print the random number
print(\"Random number:\", random_number)<\/code><\/pre>\n\n\n\n
Developer -2 Code<\/p>\n\n\n\n
import modern

# generate a random number between 1 and 10
modern_number = modern.randint(1, 10)

# print the random number
print(\"Modern number:\", modern_number)<\/code><\/pre>\n\n\n\n
Based on above review \u2014 Technical Architect realised that developer-1 and developer 2 imported some libraries and there is possibility of having more modules , libraries , packages which are not getting scanned from their internal security team. Architect asked the Project Manager to collect the the list of Modules\/packages\/libraries used while developing the module.<\/p>\n\n\n\n
Project Manager interacted with Development team and created detailed list (including vendor details , licensing and version) of Software\/Modules\/Packages used to build the Software module. This List is called \u201cSoftware Bill of Material\u201d or SBOM.<\/p>\n\n\n\n
\u201cSBOM \u2014 Is it Important or beneficial to integrate ?\u201d<\/em><\/strong><\/p>\n\n\n\n
Following are the benefits of creating the SBOM :<\/p>\n\n\n\n