{"id":27641,"date":"2022-02-02T19:02:56","date_gmt":"2022-02-02T19:02:56","guid":{"rendered":"https:\/\/rbsitsoftwaresolution.com\/blog\/securing-the-open-source-ecosystem-sboms-are-no-longer-optional.html"},"modified":"2022-02-02T19:02:56","modified_gmt":"2022-02-02T19:02:56","slug":"securing-the-open-source-ecosystem-sboms-are-no-longer-optional","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/securing-the-open-source-ecosystem-sboms-are-no-longer-optional.html","title":{"rendered":"Securing the open source ecosystem: SBOMs are no longer optional"},"content":{"rendered":"

In the last year and a half, one cybersecurity mess after another — the SolarWinds software supply chain attack<\/a>, the\u00a0log4j vulnerability<\/a>, the npm bad code injection — have made it clear that we must clean up our software supply chain. That’s impossible to do with proprietary software, since its creators won’t let you know what’s inside a program. But with open-source programs, it can be done.\u00a0<\/p>\n

Here’s the progress we’ve made so far, according to the Linux Foundation<\/a> in its new The State of Software Bill of Materials and Cybersecurity Readiness<\/a> report.<\/p>\n

The Linux Foundation,\u00a0OpenSSF<\/a>, SPDX<\/a>, and OpenChain<\/a>\u00a0have been working on securing the software supply chain long before President Joe Biden signed an executive order to boost the federal government’s cyber defense<\/a>. This order says open-source software must try to provide a Software Bill of Materials (SBOM).\u00a0<\/p>\n

The order defines an SBOM as “a formal record containing the details and supply chain relationships of various components used in building software.” It’s an especially important issue with open-source software, since “software developers and vendors often create products by assembling existing open source and commercial software components.”<\/p>\n

How often? The managed open-source company Tidelift<\/a> reports that 92% of applications contain open-source components<\/a>. In fact, the average modern program is made up of 70% open-source software<\/p>\n

Also:\u00a0<\/strong>In 2022, security will be priority number one for Linux and open-source developers<\/strong><\/a><\/p>\n

Jim Zemlin, the Linux Foundation’s executive director, writes, “SBOMs are no longer optional. Our Linux Foundation Research team revealed 78% of organizations expect to produce or consume SBOMs in 2022. Businesses accelerating SBOM adoption following the publication of the new ISO standard 5962<\/a> or the White House Executive Order are not only improving the quality of their software, but they are also better preparing themselves to thwart adversarial attacks following new open-source vulnerability disclosures like those tied to log4j.”<\/p>\n

\n<\/section>\n

The SBOM ISO standard 5962 is the work of SPDX. a Linux Foundation-related project.\u00a0<\/p>\n

According to this standard, an SBOM is a formal and machine-readable metadata that uniquely identifies a software component and its contents. It may also include copyright and license data. If you think of it as a recipe for a program, you won’t be far off.\u00a0<\/p>\n

\n\t\tZDNet Recommends<\/span>
\n\t<\/h3>\n

<\/p>\n

<\/span><\/p>\n

<\/a><\/p>\n

\n
\n The best Linux Foundation classes
\n <\/a>\n <\/p>\n

Want a good tech job? Then you need to know Linux and open-source software. One of the best ways to learn is via a Linux Foundation course.<\/p>\n

\n Read More<\/a>\n <\/p>\n

SBOMs are shared across organizations and provide component transparency in a software supply chain. Many organizations concerned about application security are making SBOMs a cornerstone of their cybersecurity strategy. It’s the one way they can be sure they know what ingredients they’re using in their programs.\u00a0<\/p>\n

Linux Foundation Research conducted a worldwide survey into organizational SBOM readiness and adoption in the third quarter of 2021. A total of 412 organizations from around the world participated in the 65-question survey. Stephen Hendrick, the Linux Foundation’s VP of Research authored the report.\u00a0<\/p>\n

Key findings from the survey include:<\/p>\n