Back to home

Introduction to Software Bill of Materials

Software Bill of Materials (SBOMs) provides a comprehensive list of components that make up a particular software package or application. It serves as a transparent and informative inventory, similar to an ingredient list on the side of a box of cereal.

Why are SBOMs important?

SBOMs enable consumers to make informed decisions about the software they use. They provide crucial visibility into the software supply chain, which is increasingly essential. With SBOMs, organizations can better understand and manage the risk exposure introduced by third-party components.


Supply Chains are Graphs

A critical aspect of SBOMs, regardless of the format, is that they can represent software components as a graph. This is important because software supply chains are fundamentally graphs themselves, with components connected through complex relationships. SBOMs model these interconnections between different components, allowing us to visualize and understand how they are linked. This graph-based approach is a powerful concept that can be leveraged to identify vulnerabilities and track the flow of software components throughout the entire supply chain ecosystem.



More specifically, a single SBOM document provided by a software vendor only captures a subgraph of the overarching software supply chain graph.



To truly understand the full context and implications of a particular software package, we need a more comprehensive view of the supply chain. This may require traversing and integrating additional graphs containing detailed information like vulnerability data, function call hierarchies, or specific build environment details used to create the component.


Since not all of this supplementary information may be included in a vendor's SBOM, so it is crucial to recognize that the SBOM itself is just one piece of a much larger interconnected puzzle. We can also can't forget that these graphs are constantly evolving.


Historical Context

To help put all this SBOM stuff into perspective, let's revisit some major cybersecurity incidents from recent years. In 2018, the Equifax breach was caused by a known vulnerability in Apache Struts (CVE-2017-5638), which was used in one of their web applications. Despite the patch's availability, Equifax failed to update their software, allowing the exploit.


Fast forward to 2021, the SolarWinds breach was a supply chain attack where hackers compromised SolarWinds' build system and injected malware into Orion software updates, distributing it to thousands of customers. An SBOM could have enabled SolarWinds' customers to better understand Orion's components, identifying the compromised updates more easily.


Then, in 2022, the Log4Shell (CVE-2021-44228) vulnerability was discovered in the popular Java logging library, Log4j. This vulnerability was widely exploited, and affected thousands of organizations. An SBOM would have made it easier for organizations to understand the components of their software, and identify the affected versions of Log4j.


  1. Apache Struts

    Equifax failed to update their software, and suffered a massive breach as a result.

  2. SolarWinds

    Hackers compromised the SolarWinds build system, and injected malware into the Orion software updates.

  3. Log4Shell

    The Log4Shell vulnerability was widely exploited, and affected thousands of organizations.


To combat the growing threat of cyber attacks, the Biden administration issued an executive order requiring SBOMs for all software sold to the federal government.



Continue Reading