Organizations and developers who create and maintain software may have software bills of materials (SBOMs) but don’t quite hit the mark when creating them. Sure, they know SBOMs are important for software transparency and vulnerability tracking. However, knowing they’re important and making rock-solid SBOMs are different.
In our previous blog, we’ve discussed in detail what SBOMs are. Now we dive into SBOMs, the need for the right ingredients (fundamentals), and a dash of know-how (SBOM best practices) to turn them into documents for supply chain security. So, let’s dive into those best practices and fundamentals you need to know to create SBOMs.
Before getting into the nitty gritty of SBOM best practices, it’s first important to understand the fundamental components of an effective SBOM. Here are all the things developers must include:
After Joe Biden’s Executive Order highlighted the importance of the software bill of materials, the National Telecommunications and Information Administration (NTIA) released a document discussing SBOM in detail. Here are some SBOM best practices this document mentions that organizations should consider.
The first and most important SBOM best practice organizations should implement is creating a structured framework for handling their software components. These policies and procedures help organizations define the rules for creating, maintaining, and updating SBOMs. They also define the step-by-step process, ensuring that everyone in the organization knows what to do and how to do it. This clarity minimizes confusion, reduces errors, and enhances consistency in SBOM management.
Another SBOM best practice organizations should follow when creating SBOMs is using standard or uniform data formats for component inventory. Standard formats ensure uniformity, interoperability, and ease of understanding across different software projects and organizations. Three of the most commonly used SBOM formats are SPDX (Software Package Data Exchange), Software Identification (SWID) tags, and CycloneDX.
Manually creating SBOMs can be a labor-intensive process that involves tracking down every software component and its dependencies, collecting metadata, and formatting it correctly. This process becomes increasingly cumbersome in large-scale software projects with numerous dependencies and frequent updates. When organizations automate these processes, creating SBOMs becomes easy.
One way to automate SBOM generation is to use Kiuwan Software Composition Analysis (SCA) tools. SCA tools start by scanning the source code or binary files of a software project. They conduct security risk assessments by analyzing the code to identify libraries, frameworks, and third-party components on which the software relies. Once the tools find a software component, they perform a dependency management assessment.
They also identify other components on which the software component relies, creating a hierarchical view of dependencies. Another benefit is that they’ll gather additional metadata about the components, such as their origin (where it was downloaded or sourced from), maintainers, and any relevant URLs or documentation.
Regularly updating the software bill of materials is essential to maintain the accuracy and relevance of the information it contains. Organizations can do this by setting a schedule for SBOM updates. The frequency of updates may vary depending on the nature of the software projects, but it’s advisable to align updates with software development milestones or regular maintenance cycles.
Dev teams can also automate the SBOM update process. Integration with automation tools such as SCA tools can automatically identify changes in dependencies and vulnerabilities, making the update process more efficient and less error-prone.
While SBOMs should be readily available for users, organizations must be extremely careful in how they store them and who can access them. This is because while SBOMs are required to be public knowledge, especially for developers creating open-source components, they should be securely stored with restricted access. When access controls are necessary, organizations should specify these in the SBOM with specific allowances and accommodations for how users use SBOM data.
NTIA mentions allowing for errors in SBOM creation. It acknowledges that while the SBOM data captured should be thoroughly scrutinized, there may be errors and omissions. In other words, organizations should have disclaimers in the SBOMs for errors, and consumers should tolerate them. (But don’t consider this an opportunity to ignore or omit information intentionally.)
SBOM best practices emphasize not just documenting the key components of software; they are essential for helping organizations and developers ensure their software meets legal compliance regulations and security standards. Kiuwan’s Software Composition Analysis (SCA) provides the components and information you need to create your SBOMs.Get a personalized demo and a free trial to try Kiuwan’s SBOM features.
