What Is SBOM (Software Bill of Materials)?

A Software Bill of Materials (SBOM) is detail inventory of components that make up a software, including third-party and open-sources libraries, and framework version. It’s like list of ingredient inside the application.

By keeping track every component inside application, the dev team can quicky detect when new vulnerabilitiies discover.

Why SBOM Matters in Cybersecurity

Modern application built by combining hundred or thousands third-party dependencies and open-source libraries to accelerate development. If one of those have vulnerabilities, it will place whole application into risk.

an SBOM help developer team to :

• Identify vulnerabilities earlier by mapping affected component
• Improve compliances with standards like NIST, ISO, or Executive Order 14028 in the U.S.
• Enhance supply chain security by ensuring transparency in software composition
• Build trust with customers and partners by showing what components are included

Key Elements of an SBOM

A proper SBOM usually includes:

• Component name (e.g., lodash)
• Version (e.g., 4.17.21)
• License information (open source or proprietary)
• Supplier (project or vendor that maintains it)
• Relationships (how components depend on each other)

Example in Practice: The Apache Struts Breach (Equifax, 2017)

In 2017 attacker exploit critical vulnerability in Apache Struts Apache Struts framework (CVE-2017-5638), which was used in Equifax’s (American multinational consumer credit reporting agency) web applications. The patch of this vulnerability was available, but Equifax failed to apply in time.

Because the lacked visibility into all dependencies and libraries inside their application, the falw in Struts library went unnoticed, it lead to one of the largest data breaches in history, more than 147 million personal data exposed.

If an SBOM had been in place, Equifax could have quickly:

• Identified that their applications were using the vulnerable version of Apache Struts
• Prioritized patching as soon as the vulnerability was disclosed
• Reduced the time attackers had to exploit the weakness

This case make us know how an SBOM have critical role to keep software components safe, helping organization act faster to newly disclose vulnerabilities

Related Terms

• SCA (Software Composition Analysis)
• Software Supply Chain Security
• Open Source Audit
• Vulnerability Management