SBOMs Are Not Enough

SBOMs Are Not Enough Bridging the Gaps in Software Supply Chain Security Brian Demers Developer Advocate bdemers

Topics • What is an SBOM • How SBOMs are created • Problems • Solutions • Future bdemers

Who is this guy? bdemers

source: Silicon Valley bdemers

VS bdemers

VS bdemers

Developer Productivity Engineering bdemers

The Software Supply Chain Challenge Complex. bdemers

Something Something Security… Governance, Risk Management, and Compliance (GRC) bdemers

Pancakes! • Recipe • Ingredients • Instructions

Enter the SBOM • bdemers List of Dependencies • Version • Name • License • Other metadata

Dependencies - pom.xml … … bdemers <dependencies> <dependency> <groupId>dev.diceroll</groupId> <artifactId>dice-parser</artifactId> <version>0.3.0</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> </dependencies>

bdemers

xkcd.com/927

SBOM Entry (Example) { “type” : “library”, “bom-ref” : “pkg:maven/org.testng/testng@7.5.1?type=jar”, “purl” : “pkg:maven/org.testng/testng@7.5.1?type=jar”, “group” : “org.testng”, “name” : “testng”, “version” : “7.5.1”, “description” : “Testing framework for Java”, “scope” : “required”, “hashes” : [ { “alg” : “SHA-256”, “content” : “a5ac92d2362ccb3a509abe68e385ca809a7c96fcbaf851b3ee8bacb2ac899e2f” }, { “alg” : “SHA-512”, “content” : “0bdf858bd678e0887709cc2598f8857b4b86184af7a7dbb3cd20bb6b39c20587ea135fa3bbe645d9d863df78ed4cd67637edd248ed6c454db…” } ], “licenses” : [ { “license” : { “id” : “Apache-2.0” } } ], “externalReferences” : [ { “type” : “website”, “url” : “https://testng.org” }, { “type” : “issue-tracker”, “url” : “https://github.com/cbeust/testng/issues” }, { “type” : “vcs”, “url” : “https://github.com/cbeust/testng.git” } ] }, bdemers

Quick Demo bdemers

SBOMs from Container Images bdemers

Accuracy Issues with Scanning bdemers

Limited View: Runtime Dependencies • No tool chain data • Might not support your packages • TODO bdemers

Build-Time == Accuracy • Has context about build • Dependency scopes (runtime, compile, test, etc) • Annotation processors • Know where artifacts came from • If they were transformed bdemers

Inventory • What to do with SBOMs? • What do you do when there is an issue?

Frozen Pancakes? • Who is buying these? • How were they made?

Batch / Lot Codes bdemers

Are SBOMs Enough? NO! bdemers

Missing Context: How Was It Built? bdemers

Beyond Runtime: The Importance of the Build • Origin of dependencies? • What compiler? • CI plugins? • CI Host / Agent info • bdemers

XZ Utils Vulnerability bdemers

Lessons from XZ Utils • Treat your toolchain like production • Single committer projects are high risk • Attackers will target weakest points in the supply chain bdemers

SpotBugs Key Leak • spotbugs/spotobugs • reviewdog/action-setup • tj-actions/eslint-changed-files • Users of tj-actions/eslint-changed-files bdemers

Lessions Learned • Security is hard! • Toolchains are complex • A list of runtime dependencies is not enough • Pin GitHub actions to SHA bdemers

SBOMs and what else? bdemers

Provenance prov·e·nance (noun) 1: Origin, Source 2: the history of ownership of a valued object or work of art or literature bdemers

SLSA: Securing the Entire Supply Chain Level Description Example 1 Documentation of the build process Unsigned provenance 2 Tamper resistance of the build service Hosted source/build, signed provenance 3 Extra resistance to speci c threats Security controls on host, non-falsi able provenance 4 Highest levels of con dence and trust Two-party review + hermetic builds fi fi fi bdemers

Veri able Truth: in-toto Attestations g n i ign S e l p im e S p o d l a e v n De E , e l r , a e J g a m i I OC etc d e od c n E 4 6 e N s a O B JS a m he Sc A fi fi bdemers t c fa

Confession v1.6 added “formulation” bdemers

A More Secure Future 🍺+🍔 Better Together bdemers

The Path Forward bdemers

Questions? Thank you! bdemers bdemers.io bdemers Learn more