September 2022 Summaries

The discourse around Software Bills of Materials (SBOMs) highlights their potential as tools for transparency in software supply chains, akin to nutritional labels for food, but underscores the current challenges in their adoption and implementation. SBOMs aim to provide detailed insights into software components, enhancing risk management and decision-making. However, issues such as inconsistent data quality, lack of standardized practices, and mixed incentives for software vendors hinder their effectiveness. Despite being a requirement in some government procurement processes, many organizations have yet to fully operationalize SBOMs beyond basic security literacy signals. The article argues for stronger industry standards, clearer data requirements, and incentives to promote transparency, suggesting that the movement for SBOMs is promising but needs strategic focus and collaboration to realize its potential fully.

Modern software development often relies on numerous open-source components, which, despite boosting productivity, pose security risks due to potential vulnerabilities in their dependencies. To address this, the OpenSSF Scorecard provides an automated tool that evaluates the security health of open-source software by assigning scores based on various security checks, such as code reviews and branch protection, making it easier for organizations to improve their security posture. The recent release of the Scorecard API enhances its utility by allowing users to access a dataset to track and enforce policies on dependencies more efficiently, thereby maintaining a high-quality bar for new dependencies and mitigating risks associated with rapid growth and outdated components. This API facilitates ongoing evaluations of dependencies, such as identifying whether they utilize fuzzing, a method to discover vulnerabilities, thereby strengthening the software supply chain's overall security.