February 2023 Summaries

Creating accurate Software Bill of Materials (SBOMs) and comparing them across different tools is a complex task, as highlighted by a case study involving four SBOM generators: CycloneDX Maven Plugin, Eclipse jbom, Syft, and Trivy. The study, motivated by interest from previous talks and webinars, offers a script for reproducing results and applying them to various projects. The SBOMs were evaluated based on their ability to identify compile and runtime dependencies in a Java/Maven project, using the Maven Dependency Plugin as a benchmark. The analysis focused on false-negatives, where missing components in the SBOM affect accuracy, and highlighted the challenges posed by optional fields and the variability of dependency identification across different stages of the development lifecycle. The study emphasizes the difficulty of establishing a ground truth for SBOMs and the importance of PURLs in automating this process, while acknowledging the limitations of not considering other identifiers like CPEs or digests. The shared script aims to facilitate the systematic evaluation and comparison of SBOMs, maintaining simplicity for transparency and ease of modification.

Endor Labs has achieved a System and Organization Controls (SOC) 2 Type I certification, affirming its stringent information security and data protection measures. The SOC 2 standard, created by the American Institute of Certified Public Accountants (AICPA), assesses controls related to security, availability, processing integrity, confidentiality, and privacy of customer data. Endor Labs' audit resulted in a "clean" report with no exceptions, highlighting its dedication to safeguarding customer information. The company aids security and engineering teams in managing open source software dependencies by emphasizing improved selection, governance policy enforcement, supply chain security, and compliance with emerging standards. This involves evaluating dependencies on various quality and security metrics, using static analysis to prioritize vulnerabilities, optimizing dependency management to reduce risks, and creating comprehensive Software Bill of Materials (SBOMs) and Vulnerability and Exploitability eXchange (VEX) documents.

Endor Labs is participating in BlackHat 2026 in Las Vegas, offering insights into open-source security through webinars and tutorials. A recent webinar introduces key concepts like direct and transitive dependencies and identifies top open-source risks, while also providing a detailed overview of an end-to-end code security pipeline. Published by Ron Harnik, the content highlights related topics such as building a DevSecOps practice and managing Software Bills of Materials (SBOMs) to detect vulnerabilities efficiently. Additionally, Endor Labs has announced new support for Python, Go, and C# in their Reachability-Based Software Composition Analysis (SCA) tool, enhancing their open-source offerings.

A webinar hosted by Joseph Hejderup and Henrik Plate discusses the importance of Software Bill of Materials (SBOMs) across different lifecycle stages, highlighting a case study of an application with varying SBOMs and the enrichment of SBOMs using call graphs. Additionally, related topics covered include vulnerabilities in Apache Struts that could lead to remote code execution, the necessity for enterprises to apply Zero Trust security principles to open source software, and a blog that explores the government's role in maintaining open source security. These discussions emphasize the critical need for robust security measures in handling open source software and the software supply chain.

An empirical study by Xia et al. explored the expectations and practical realities of Software Bill of Materials (SBOMs), highlighting that ideal SBOMs should be generated early in the software development lifecycle and updated continuously. A case study was conducted to compare SBOMs from different open-source generators at various lifecycle stages, revealing significant discrepancies due to differing detection capabilities and detail levels in Package URLs. The study used Eclipse Steady v3.2.5 as a test subject and found that the precision and recall of SBOMs varied greatly among the tools, with a Maven-integrated tool achieving perfect results. The research emphasized the importance of knowing a product's ground truth to assess SBOM accuracy, noting potential risks from false positives or negatives. It also raised questions about the practical value of qualifiers in PURLs and recommended that SBOMs clearly distinguish between components used in development versus those in the final product. The authors called for a benchmark to evaluate SBOM generators' accuracy across different programming languages and technology stacks, aiming to build industry confidence in SBOM quality.