Since our previous discussion on the EU Cyber Resilience Act (CRA) and Software Bill of Materials (SBOMs), significant updates have clarified and expanded the framework for compliance. The European Parliament approved the CRA on March 12th, marking its importance in enhancing product security across the EU. This follow-up explain these developments, focusing on new guidelines and the evolving expectations for SBOM compliance.
New clarity on SBOMs from Germany: TR-03183
To provide more detailed guidance, Germany’s Federal Office of Information Security (BSI) released the Technical Guideline TR-03183: Cyber Resilience Requirements for Manufacturers and Products (Part 2: Software Bill of Materials (SBOM)), version 2.0. This 20-page document sets the groundwork for SBOM requirements under the CRA. Key highlights include:
Mandatory SBOM Compilation: An SBOM is essential for meeting CRA compliance.
Minimum Information Requirements: The SBOM must include the component name, version, dependencies, license (preferably using SPDX or ScanCode identifiers), and a SHA-256 hash.
Version-Specific SBOMs: A separate SBOM must be generated for each software version, with updates made only for error corrections or new information.
Preferred Formats: SBOMs must adhere to CycloneDX (v1.4 or higher) or SPDX (v2.3 or higher).
Process Integration: The SBOM must be generated as part of the build process or an equivalent mechanism.
Other recommendations, such as using CSAF with a VEX profile for distributing vulnerability information, aim to enhance transparency without directly embedding vulnerabilities in the SBOM.
Challenges in SBOM Implementation
While TR-03183 provides critical guidance, several unresolved issues highlight the complexities of SBOM creation and usage:
Identification Gaps: The absence of mandatory CPE or PURL requirements makes vulnerability reporting from SBOMs prone to errors.
Undefined “Scope of Delivery”: The guidelines use this term to define the depth of transitive component enumeration but lack clarity on acceptable thresholds.
SHA-256 Ambiguity: The methodology for computing a SHA-256 hash of source code remains unspecified.
Relationship Details: While all transitive components must be recursively included, relationships among them are not explicitly required. This omission can hinder the effectiveness of SBOMs in vulnerability management.
Preparing for CRA Compliance
The CRA’s adoption signals a critical need for manufacturers and software developers to refine their compliance strategies. With enforcement set for early 2027, organisations should prioritise:
Automating SBOM Generation: Tools like Meterian can streamline SBOM creation, ensuring accurate dependency mapping and compliance with CRA’s format requirements.
Enhancing Vulnerability Management: Despite the lack of mandatory CPE or PURL, integrating these identifiers into internal processes can improve accuracy.
Staying Updated: Monitoring updates to technical guidelines like TR-03183 will be vital as CRA implementation progresses.
Looking ahead
The CRA represents a significant step forward in securing the digital ecosystem. By leveraging clear guidelines and robust tools, organisations can align with compliance requirements while strengthening their cybersecurity posture. The publication of TR-03183 marks progress but also underscores the need for continued refinement as industry feedback shapes the future of SBOM practices.
Navigating the complexities of SBOM creation and CRA compliance doesn’t have to be overwhelming. Meterian provides automated solutions designed to simplify the generation and management of SBOMs, ensuring:
Effortless Compliance: Meterian supports both CycloneDX format, helping you meet the CRA’s technical requirements with ease.
Comprehensive Dependency Mapping: Automatically scans your codebase to identify all components and transitive dependencies, ensuring nothing is missed.
Ongoing Vulnerability Monitoring: Integrates seamlessly with vulnerability databases to keep your SBOMs updated and your products secure.
Time-Saving Automation: Embeds SBOM generation into your build processes, reducing manual effort and increasing efficiency.
With Meterian, you can confidently meet CRA requirements while enhancing your overall security posture. Contact us to learn how we can support your journey toward compliance and beyond.
Attacks through open source are growing year on year, so companies cannot rely only on periodic pen testing. The code needs to be scanned on a daily basis during the lifecycle of the application’s development stages, and continue to do so once an application is deployed.
Modern software development in fact heavily relies on open-source components: they accelerate development, reduce costs, and provide access to well-tested, community-maintained code. Understanding the composition of their software products is crucial for companies producing applications, as it helps manage and secure the significant portion of their codebase that originates from open-source projects.
Checking open-source components in software development is crucial for at least three reasons: let’s have a closer look and clarify the problems.
Security Risks
The code of open-source components is always publicly available and it is a natural target for hackers. Each day, more than 50 new vulnerabilities are discovered in open-source components and, if not identified and managed, they can be exploited, leading to security breaches.
the iCloud and Minecraft hack (2021): Log4j vulnerability (CVE-2021-44228)
All these hacks were performed using a vulnerability in an open-source component: nothing was wrong with the code written by the respective developers.
How common are vulnerabilities? See, in this sample, the growth of vulnerabilities in the .NET open-source ecosystem:
Please note that this is a restricted view that matches exclusively only vulnerabilities affecting opensource components specific to the .NET ecosystem. Across all ecosystems, more than 100,000 vulnerabilities affecting open-source components are recorded.
The risks are real. If you want to learn more you can also read our blog here.
License compliance
Open-source components come with various licenses, each with specific requirements and restrictions. Failing to comply with these licenses can lead to legal issues, including copyright infringement claims.
Among all those, let’s not forget TruthSocial, the famous Twitter clone created by the Trump Media & Technology Group, was found to be in breach of an OSS license and had to disclose its source code publicly.
The risks are real. If you want to learn more you can also read our blog here.
Quality and reliability
While open-source software can be of high quality, this varies significantly, and some components might be abandoned or poorly maintained. Using such components can pose risks to the project’s stability and reliability.
Here introducing you Swashbuckle, a popular .NET project that has been abandoned by his creator for a more interesting adventures and now lays unmaintained and without an owner. It was last updated 6 (six) years ago.
Let’s also have a look at Lazy, another popular NodeJS component that was last updated 11 (eleven) years ago. While it’s a small library with a limited attach surface, why would you like to have this in your application? Software does not age like fine wine, unfortunately.
This is an example of two commonly used opensource components that have not been updated in years, a very long time in software development. Those components are basically not maintained anymore: if a problem is found, it won’t be fixed. If a vulnerability is there, nobody will know about it (apart from the occasional hacker, of course)
How Meterian SCA helps solve the challenge
Meterian offers a comprehensive application security platform designed to enhance the security posture, compliance adherence, and overall quality of software projects. This platform provides in-depth analysis and automation capabilities, empowering organisations to effectively manage open-source and third-party libraries throughout their software development lifecycle. Through its robust features, Meterian enables organisations to identify and mitigate vulnerabilities, ensure compliance with relevant regulations and standards, and maintain a high level of software quality.
Meterian is unique compared to its competitors because of various characteristics, let’s explore them
Supports the largest number of ecosystems If you are using a legacy technology like Perl, focus on data science using Jupyter Notebooks, build video games with Unity, or build ultra-fast micro-services with Rust, you deserve the best protection available. Meterian supports a wide range of languages and ecosystems, and if your platform is not there, we will be happy to support it for you.
Easy to to deploy on premises or dedicated cloud In the SaaS industry, the requirement for a dedicated single-tenant instance or an on-premises installation may be driven by specific business needs, such as tight security, data sovereignty, and geo-location considerations. Meterian can easily provide a single-tenant environment, either on-cloud or on-prem, and offers also a range of air-gapped solutions for extreme secure environments.
Comprehensive vulnerability database Meterian’s vulnerability database not only boasts a broader coverage than any of its competitors but is also updated daily through a fully automated system that integrates numerous OSINT sources and Meterian’s specially curated databases, including AI-generated advisories directly from the analysis of open-source repositories. This automated process outpaces manual entry methods, ensuring we maintain a competitive edge through faster and more efficient updates, a key differentiation in our service offering.
Superior customer support Speed, quality of responses, customer obsession, won deals because of this. We have a unique culture where the concept of “support” does not really exist, as all engineers are constantly working with customers. We want to be obsessed with customers, solve their problems quickly and effectively. Every customer support query is directly handled by engineers and is given priority in our backlog. This approach guarantees that our product evolves in response to real-world feedback, while also maintaining the highest level of customer satisfaction.
What next?
Don’t just take our word for it – experience the benefits for yourself. We invite you to schedule a demo to see how our solution can make a difference in your organisation’s security posture. Our team of experts is ready to guide you through the features and show you how it can address your specific security challenges. Take the first step towards a more secure future – reach out today and discover how Meterian can elevate your cybersecurity strategy.
As healthcare companies face a complex web of EU and US regulations, understanding and adhering to these standards is crucial for maintaining trust and operational continuity. Regulations such as the EU’s Medical Device Regulation (MDR), the Network Information Security (NIS) directive, and upcoming legislation like the Cyber Resilience Act (CRA) and Digital Operational Resilience Act (DORA) demand meticulous compliance and robust cybersecurity measures.
Specifically, MDR requires stringent oversight of software used within medical devices, demanding thorough documentation and regular updates to ensure safety and performance. Meterian simplifies these tasks by automating the detection of vulnerabilities and outdated components in software, facilitating compliance through comprehensive Software Bill of Materials (SBOMs). These SBOMs provide a detailed inventory of all software components, crucial for MDR compliance, and help healthcare organisations maintain the integrity and security of their medical devices. By streamlining these processes, Meterian not only aids in meeting regulatory requirements but also enhances operational efficiency and reduces the risk of non-compliance penalties.
Meterian stands as a pivotal ally for healthcare companies navigating these regulatory landscapes. By offering tools that facilitate compliance with these stringent regulations, Meterian ensures that healthcare providers can focus more on patient care and less on the nuances of cybersecurity compliance.
The conversation around SBOMs and compliance is growing, and Meterian is leading these discussions with healthcare companies, showcasing how automation and detailed compliance reporting can ease the burden on healthcare providers. Whether it’s a startup or a seasoned enterprise, Meterian’s scalable solutions fit diverse budgets and operational scales, making comprehensive cybersecurity accessible to all healthcare entities.
By partnering with Meterian, healthcare companies not only ensure compliance with current regulations but also prepare for future legislative changes. Meterian’s proactive approach helps companies anticipate and adapt to the regulatory landscape, ensuring that they are always one step ahead in their cybersecurity measures.
Are you ready to elevate your healthcare organisation’s compliance and cybersecurity strategy?
Partner with Meterian today to ensure that your technology infrastructure meets the stringent demands of regulations like the NIS Directive and MDR. Don’t wait until a cybersecurity incident occurs – take proactive steps to safeguard your patient data and systems.
Visit our website or contact us to learn how Meterian can help your healthcare organisation stay secure, compliant, and resilient in an ever-evolving digital landscape.
In the digital age, healthcare companies are guardians of vast amounts of sensitive user data, ranging from personal health records to financial information. With this responsibility comes the challenge of ensuring data integrity and security against the growing threats of cyberattacks and data breaches. Meterian, a leader in application security, is at the forefront of providing solutions that safeguard this critical data.
Healthcare providers harnessing open-source software face unique security risks that require vigilant management and protection strategies. Meterian’s innovative tools actively scan and identify vulnerabilities within applications, ensuring that all components are up to date and secure against potential threats. By leveraging Meterian’s capabilities, healthcare companies can not only protect their patient data but also enhance their overall cybersecurity posture.
Protecting patient records.
In collaboration with Emis Group, a well-established brand in healthcare technology, Meterian has demonstrated its value in real-world applications. Emis has utilised Meterian’s solutions to bolster their applications’ defences, thereby protecting millions of patient records. While our partnership with Emis illustrates Meterian’s capability to handle the complex cybersecurity needs of large enterprises, it’s important to recognise that our solutions are equally effective and accessible for SMEs and startups. Meterian understands the unique challenges faced by smaller organisations, including tighter budgets and limited resources, as our platform is designed to be flexible and scalable.
For healthcare organisations, the fear of missing out on the highest level of security should be a significant concern. Meterian provides an essential layer of security that automates and streamlines the detection and management of vulnerabilities—tasks that would otherwise consume valuable development resources. As legislation evolves and compliance becomes even more stringent, Meterian’s tools help healthcare companies stay ahead, ensuring they meet all regulatory requirements while securing user data against emerging threats.
A successful case study.
To see first – hand how Meterian is enhancing cybersecurity in the healthcare industry, we invite you to explore our success story with Emis Group. This case study provides a detailed look at how Emis leveraged Meterian’s cutting-edge solutions to fortify their application security, ensuring compliance with stringent regulations and protecting sensitive patient data.
The UK government’s flagship cyber security event, CyberUK 2024. is just around the corner! Hosted by the National Cyber Security Centre (NCSC), this annual gathering brings together over 2,000 cyber security leaders and professionals for networking, knowledge exchange, and collaboration.
We will be exhibiting at CyberUK 2024. Loved by SMEs and CNI, our secure-by-design agile approach to software development delights developers and compliance teams. Come and learn how Meterian protects the Open Source Software Supply Chain.
Visit us Stand IZ3 at the Birmingham ICC, May 13-15th.
The open-source software (OSS) ecosystem thrives on the principles of transparency and collaborative development. However, a recent critical vulnerability discovered in the core library, liblzma, has cast a shadow on this trust. The vulnerability, which was disguised as a bug fix, contained malicious code that could have potentially granted attackers access to users’ systems through SSH servers. This unsettling incident serves as a sobering reminder of the tangible risks inherent in relying on third-party software packages, even within the seemingly open and collaborative realm of OSS.
What happened?
liblzma, a critical library used for compression in many Linux distributions, was compromised by a backdoor hidden within its source code. This backdoor, attributed to a contributor named Jia T75, remained undetected for two years. During the build process, the backdoor would infect the system, specifically targeting x86_64 Linux systems. This vulnerability could have allowed attackers to compromise SSH servers, potentially granting them unauthorized access to a user’s system.
Why third-party packages are a risk
While OSS thrives on collaboration, it also introduces vulnerabilities. We rely on the good faith of developers contributing code. Malicious actors can exploit this trust by injecting backdoors or other harmful code into seemingly legitimate libraries like liblzma.
What can you Do?
To mitigate the risks associated with third-party software packages, it is imperative to stay vigilant and proactive. Patching software promptly by updating your system regularly ensures you have the latest security fixes in place. Furthermore, exercising caution when obtaining software updates and packages by exclusively utilizing official or trusted sources is of utmost importance. Thoroughly researching the maintainers of the software packages you rely upon can shed light on their track record of responsible updates and reputation within the community. Whenever feasible, exploring alternatives to widely used libraries can be a prudent strategy, as diversifying your software portfolio can reduce the potential impact of a single vulnerability. By adopting these measures, you can bolster the security posture of your systems and minimize the risks posed by third-party software dependencies.
How Meterian can help
The liblzma backdoor incident serves as a wake-up call, and it highlights the need for constant vigilance. By understanding the risks and taking preventative measures, we can build a more secure software ecosystem. Remember, security is an ongoing process, not a one-time fix .
Security solutions like Meterian can be powerful allies in mitigating the risks of third-party packages. Meterian’s notification system keeps you informed about the latest vulnerabilities impacting your software ecosystem, including critical flaws like the recently discovered liblzma backdoor. Through timely alerts and detailed reporting, Meterian ensures you stay on top of potential threats before they can be exploited]. Additionally, Meterian’s Software Composition Analysis (SCA) solution goes a step further by scanning your codebase for known vulnerabilities within dependencies like liblzma. By proactively identifying these risks, SCA allows you to take early action and prioritize patching vulnerable components, ultimately safeguarding your systems and data.
Don’t wait for the next major vulnerability to compromise your systems. Take control of your software security today. Try Meterian for free and experience the power of proactive vulnerability detection and management.
An important note!
The xz/liblzma packages are sometimes included in major Linux distributions, and much of the focus is now there, also because this vulnerability can be exploited to execute remote commands over SSH. However, please be aware that this vulnerability may affect also your application code, either because it may be linking directly liblzma in your C/C++ applications or because, via conan, you previously used the package xz_utils in one of the vulnerable versions (5.6.0, 5.6.1). Furthermore, other wrappers such as xz.ex (elixir), xz.net (dotnet), ruby-xz (ruby) and similar packages may indirectly pull the affected package.
Update – 15 April 2024
This is a novel situation, and there is still much uncertainty. We are aware of only a single known exploit path at this time, but there may be additional scenarios that have not yet been identified.
In detail, so far, it looks like the payload activates if the running program has the process name /usr/sbin/sshd, however, based on ongoing analysis, it may activate also in other scenarios too, unrelated to SSH. This matter is still investigated, you can keep an eye at this page to follow the active investigation.
How can we enjoy social gatherings in restaurants or busy spaces again? This is possible with robots, devices, space partitions and humans occupying the same space. With imagination, we will re-create the bustling spaces redefined with IoT technology.
What is IoT?
If you’re new to IoT, see from Wikipedia: “The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.”1
Basically, an IoT device is one that has an internet connection, even though normally it wouldn’t. Your smart boiler and smart thermostat are examples of IoT devices. You talk to them using an app on your smartphone. You tell the smart boiler to heat water so you can take a shower, and the smart thermostat to warm up the room to a cosy temperature by the time you arrive home.
In recent months, as the reach and severity of the COVID-19 pandemic increased, adopting IoT solutions started joining the frontline in many countries outside Asia in order to manage the crisis. With the boost in increased use of digital and remote technologies, videoconferencing has become the norm for office meetings, school lessons and exercise classes. The capabilities of video conferencing, email and messaging technologies has shown just how productive remote work can really be, with studies showing that 65% of pandemic remote workers wished to continue working from home and only 2% wished to return to the office.2
These efforts are likely to take a step further with IoT. Many countries have set up temperature measurement systems at the entrance of public places such as airports and train stations. Restaurant managers are also recording the temperature of staff who are preparing food. If this collected data (temperature) could be transferred and analysed in the cloud through an app, it could result in real-time analysis.
To orchestrate such a system requires planning and a clear understanding of what is most valuable to protect and why. There are many benefits and use cases of IoT.
Benefits of IoT
IoT, artificial intelligence, and the analysis of vast amounts of real-time data sets (aka Big Data) can be used to slow down proliferation of pandemics to avoid future global health crises. Such real-time connected intelligence, dubbed “nowcasting”, could be gained from medical devices connecting over the internet. Trend monitoring of wearable devices could analyse population-level influenza trends daily according to a recent study from Scripps Research scientists.3
As seen during COVID-19 isolation period, this preventive action to stop the virus spread combined with telehealth services lets health care providers advise patients without risking exposure.
Robot surveillance for social distance monitoring can alleviate the stress on police or community patrol since robots don’t get tired of doing repetitive tasks — observe, record, count, report and take action. 4
Key reasons for implementing IoT projects are summarized in Microsoft Azure’s IoT survey featured in their IoT Signals report, which highlight the top three reasons as improving Safety and security, Operations optimization, and Quality assurance.
During COVID-19 crisis, we have seen that doctors and health care providers can maintain some employees’ productivity while social distancing and relying on the right connected devices and computing systems. Logistics companies, supermarkets and the food supply chain can track the quality and quantity of goods and produce from shore to shop or farm to market with minimal manual effort. Eventually, the click-pick-and-collect journey of groceries delivered by Ocado5 will be done entirely with robotics. Another instance in which IoT can act as a useful tool for retail stores is by tracking consumer and employee location data. Michele Pelino, senior analyst in infrastructure and operations research at Forrester said, “The idea is to use information about location: GPS capabilities in phones. Over time, there will be more opportunities to create location-based experiences to interact with a brand”. Possibilities for the next year include the ability for customers to use GPS to check in, allowing them to maintain distance by avoiding queues.
IoT Risks
As with all new technology, great progress comes with risks in uncharted fields.
Since the explosion of the internet of things (IoT) across industries, companies providing products or services in any IoT ecosystem must carefully evaluate and examine possible threats of malicious intent.
We have been warned children’s toys6 and baby monitors’7 cameras have been hacked by strangers invading privacy and security of the home. In the UK, regulations for IoT devices are gradually being introduced to catch up with the 300% surge in cyberattacks using IoT devices8, and similarly in the US9.
In the United States, FBI warned 10 the US private sector in February: “Software supply chain companies are believed to be targeted in order to gain access to the victim’s strategic partners and/or customers, including entities supporting Industrial Control Systems (ICS) for global energy generation, transmission, and distribution”. Recently we have seen this exact industry area targeted in oil pipeline system company Colonial Pipeline’s Ransomware attack. This led to the take down of the largest fuel pipeline in the U.S., and Colonial Pipeline paying out a huge $4.4m crypto currency ransome.
In addition to attacks against supply chain software providers, the FBI said the same malware was also deployed in attacks against companies in the healthcare, energy, and financial sectors.
The Most popular supply chain attack is 2017’s NotPetya ransomware attack11. Due to a lack of patches to keep software in their Windows computer systems up to date, cyber criminals were able to gain access to computers and install a malware that spread through the networks of organizations like wildfire. Multinational companies, AP Moller-Maersk, Reckitt Benckiser and FedEx, were crippled and they were not even the target of the state-sponsored attack. Just collateral damage, and the estimated loss is $10 billion12.
Gavin Ashton recently wrote in his personal blog about his insider view of the NotPetya experience, which cost Maersk $300 million: “you should put up a damn good fight to stop these attacks in the first case. … Staying with the home analogy; Yes, there’s security cameras and wizard cloud-connected ‘Internet of Things’ (IoT) devices and all kinds of expensive measures and widgets, but a lot of organisations fail simply on the basics. Lock the damn door.”13
The Value Security Adds to Systems
Such risks and misfortunate events are avoidable and can be mitigated.
There is a range of use cases in which security indeed adds value to IoT systems. For example:
Need to prove authentic origin of products such as fresh produce or medications? Eliminate loss by tracking products with encrypted data.
Need to guarantee the integrity of data? Prevent tampering and fraud by ensuring systems have security controls for identification, authentication and authorization.
Prevent cloning/faking/tampering of trackers or meters?
Ensure data of logistics/transport/utility/food services is confidential end-to-end
individual contact tracing. Ensure tracker data is confidential end-to-end
Prevent device/software tampering that could affect pricing and billing
At home and with health care providers,
Safeguard customer privacy by preventing intrusion into home systems
Comply with patient privacy regulations by protecting data at rest (stored on devices/systems) and in motion (when sent from a device over the network to another device/system).
In the IoT ecosystem, it is crucial for organizations to have visibility into all connected devices and systems. As more employees use cloud apps and mobile devices for work, the traditional network security perimeter has lost relevance. This means more attention is needed on endpoint monitoring and protection, which includes not only employees’ devices to perform work, but also devices in the worker’s environment whether at home or at work. At work the environment may be an open plan of office desks, a clinician’s patient room, or on the assembly line of a manufacturing plant. Each environment will have its unique characteristics. For more on the role of IoT and the fight against COVID-19 in sensitive areas, read our blog: Cyber Security and IoT: Health Care and Well-Being in our Shared Spaces.
The user/actor in the environment may also vary and the device’s mobility would affect its position and environment. IoT system design must take many of these factors into consideration and use secure-by-design principles to protect the value of the information that is being moved around the ecosystem. There is no panacea to protect all aspects because in the IoT ecosystem the hardware, software, and services are provided by different vendors. Each aspect will need to be secured to be fit for its purpose within the context of its environment and ecosystem. Methods to update and/or remove devices are required to keep up with the pace of business and technological advancements.
Just as hardware devices come with basic security benefits that can be used and will need to be updated over time, the software of open source components used by IoT devices must also be maintained. Continuous updates are essential. New aspects of information and human security will need to be included. In the context of autonomous vehicles, software must be resilient against both malicious actors as terrorists as well as unauthorised but friendly users, such as a child who could use a smartphone to direct the car to go to school, for example.
Look Out Ahead for CyberSecurity in IoT
The future is not promising to be better in terms of cybersecurity threats and malicious attacks. Globally there were nearly 27.5 billion installed IoT devices number of installed IoT devices at the end of 2020, which is set to rise to 45.9 billion by 202514. So, with both of these figures growing, it is clear to see that IoT devices are the perfect vessel for cyber criminals to carry out attacks.
80% of data breaches can be prevented with basic actions, such as vulnerability assessments, patching, and proper configurations. Getting basic cyber hygiene right is critical to help prevent cyber attacks. There are always those who destroy unity and stifle positive progress. Cyber criminals unfortunately will continue to innovate with artificial intelligence to increase their attacks at machine speed from anywhere in the world and on a scale comparable to that of a pandemic.
How a Software Bill Of Materials can help prevent cyber attacks
The National Telecommunications and Information Administration (NTIA) defines a Software Bill Of Materials (SBOM) as “a complete, formally structured list of components, libraries, and modules that are required to build (i.e. compile and link) a given piece of software and the supply chain relationships between them. These components can be open source or proprietary, free or paid, and widely available or restricted access.” A bill of materials such as this acts as a comprehensive compilation of all internal parts of the software, including third party contributions. This would facilitate the tracking of individual components such as libraries or source code within software programs. With a complete and traceable inventory, companies can see and manage the risks associated with open source libraries by identifying vulnerable systems as early as possible. Furthermore, it allows developers to monitor what components they use by vetting the code in their projects. Finally, this level of transparency would allow for a more informed purchasing experience for consumers. President Biden recently formalized the importance of SBOMs through the Executive Order on Improving the Nation’s Cybersecurity15, in which it was made mandatory that all software used by the US government came with its own SBOM— so as to prevent from SolarWinds type hacks in the future.
If you are interested in automated auditing of your software applications for open source compliance risks and security vulnerabilities, get in touch.
2 Mlitz, Kimberly. “Work from home & remote work- Statistics and Facts”. Statistica, 30 March 2021, https: //www.statista.com/topics/6565/work-from-home-and-remote-work/.
3 “Fitness wearables may improve real-time tracking of seasonal influenza outbreaks.” Scripps Research, 16 January 2020, https ://www.scripps.edu/news-and-events/press-room/2020/20200116-wearable-flu.html.
4 Stieg, Cory. “This $75,000 Boston Dynamics robot ‘dog’ is for sale—take a look”. Make it, 22 June 2020, https ://www.cnbc.com/2020/06/22/75000-boston-dynamics-robot-dog-for-sale-take-a-look.html.
5 Banks, Martin. “Google Solving Together – Ocado Technology readies clients for more changes to online retail’s ‘new normal”. 15 June 2020, https ://diginomica.com/google-solving-together-ocado-technology-readies-clients-more-changes-online-retails-new-normal
6 “What did she say?! Talking doll Cayla is hacked”. 30 January 2015, https ://www.bbc.co.uk/news/av/technology-31059893 .
7 “Smart camera and baby monitor warning given by UK’s cyber-defender”. BBC News, 3 March 2020, https ://www.bbc.co.uk/news/technology-51706631.
8 Kelly Early. “What do the UK’s newly proposed IoT laws look like?”. Silicone Republic, 28 January 2020, https ://www.siliconrepublic.com/enterprise/uk-iot-internet-of-things-regulation-laws.
9 https ://www.nist.gov/internet-things-iot
11 Cimpanu, Catalin. “FBI warns about ongoing attacks against software supply chain companies”. ZD Net, 10 February 2020, https ://www.zdnet.com/article/fbi-warns-about-ongoing-attacks-against-software-supply-chain-companies/
12 Hall, Kat. “Largest advertising company in the world still wincing after NotPetya punch”. The Register, 7 July 2017, https ://www.theregister.com/2017/07/07/ad_giant_recovering_from_notpetya/.
13 Ashton, Gavin. GVNSHTN, Maersk, me & notPetya, 21 June 2020, https ://gvnshtn.com/maersk-me-notpetya/.
14 Belton, Padraig. “In 2021, as you work from home hackers eye your IoT”. Light Reading, 1 April 2021, https ://www.lightreading.com/iot/in-2021-as-you-work-from-home-hackers-eye-your-iot/d/d-id/766350
15 “Executive Order on Improving the Nation’s Cybersecurity”. The White House, 12 May 2021, https ://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/.
