Software Bill of Materials (sBOMs) - Robert A. Martin - Removing Barriers to the Application of Tooling for SCRM and Software Assurance

Sep 16, 2026

Uploaded by Finn

Software Bill of Materials (sBOMs) addresses how software-enabled systems and connected dependencies introduce risks through task dependency, supply chain, and information flow. The talk outlines why assurance must extend beyond one’s own systems to everything relied upon, highlights the opacity of the supply chain, and frames market transparency via SBOMs. It covers basics of SBOM, cross-sector use cases, guidance for using standards, including SWID and SPDX, and expected draft deliverables, plus example applications such as patch currency, automated response, and trusted component registries.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages38

Reading Time13 min

AccessFree to download

Software Bill of Materials (sBOMs)

Why systems are at risk through dependencies

Market transparency through SBOM

Use cases for sBOM

SBOM basics and implementation standards

© 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 Software Bill of Materials (sBOMs) (Removing Barriers to the application of tooling to C - SCRM and Software Assurance) Robert A . Martin Sr. Secure Software & Technology Prin . Eng. Trust & Assurance Cyber Technologies Dept. Cyber Solutions Technical Center Presented atthe DoD, DHS, NIST, and GSA sponsored Software and Supply Chain Assurance Forum hosted at MITRE McLean, VA © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 Everything is Becoming Software-Enabled and Connected, Either through Task Dependency, Supply Chain, or Information Flow Today Your System is: • attackable or • susceptible to a hazard… When this Other System gets subverted through: • an un-patched vulnerability; • a mis-configuration; • an application weakness; • a counterfeit item; • tainted software or hardware; or • the system’s susceptibility to a hazard… © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 We need to be assured that not only are our own systems trustworthy but also everything we depend upon… The Supply Chain for Software-Enabled Capabilities is Opaque © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 Market Transparency through “Software Bill of Materials” • Third party components are a known systemic risk. • Transparency can drive tools and behavior to document risk, support mitigations, and drive better SW development practices . • NTIA at Commerce launched an open, community-driven, crosssector “multistakeholder process” to promote software component transparency. • Understand the problem and define basics of SBOM • Develop use cases across sectors on how such data can be used, today and in the future . • Guidance on how to use existing standards to implement SBOM • Software ID tags (SWID) • Software Package Data Exchange (SPDX) • Expected draft deliverables late spring 2019 • More info or to join: [afriedman@ntia.doc.gov](afriedman@ntia.doc.gov) © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 Use Cases for sBOM Formulation (how it was compiled/formed) Assurance (trustworthiness of it) sBOM of a Service (sBOM of sw delivering service) Patch Currency (known fixes are applied to it) Automated Response (sBOM parsing/action) Assured Mket Transp (public DBs of components) © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45 © 2019 The MITRE Corporation. All rights reserved. Approved for Public Release; Distribution Unlimited. Case No: 18-1804-45

FAQs

Why do software-enabled and connected systems increase cybersecurity risk?

They can be attackable or susceptible to hazards that propagate through task dependency, supply chain, or information flow. Subversion can come from vulnerabilities, misconfigurations, application weaknesses, counterfeit items, or tainted software or hardware.

What is the purpose of a Software Bill of Materials (sBOM)?

An sBOM provides transparency into third-party components and supports documenting risk, enabling mitigations, and improving software development practices. It is intended to make component supply-chain information more observable across sectors.

Which standards and identifiers are referenced for implementing SBOM?

The presentation points to Software ID tags (SWID) and the Software Package Data Exchange (SPDX) as key standards/approaches for SBOM implementation.

Sep 16, 2026

Uploaded by Finn