Understanding NTIA's Minimum Elements for SBOMs: A Comprehensive Guide

 

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐒𝐁𝐎𝐌𝐬: 𝐀 𝐐𝐮𝐢𝐜𝐤 𝐆𝐮𝐢𝐝e


𝐏𝐮𝐫𝐩𝐨𝐬𝐞

𝘚𝘉𝘖𝘔𝘴 𝘧𝘰𝘳𝘮 𝘢 𝘧𝘰𝘶𝘯𝘥𝘢𝘵𝘪𝘰𝘯𝘢𝘭 𝘥𝘢𝘵𝘢 𝘭𝘢𝘺𝘦𝘳 𝘧𝘰𝘳 𝘧𝘶𝘳𝘵𝘩𝘦𝘳 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘵𝘰𝘰𝘭𝘴 𝘢𝘯𝘥 𝘱𝘳𝘢𝘤𝘵𝘪𝘤𝘦𝘴.

𝐄𝐱𝐚𝐦𝐩𝐥𝐞: 𝘐𝘮𝘢𝘨𝘪𝘯𝘦 𝘣𝘶𝘪𝘭𝘥𝘪𝘯𝘨 𝘢 𝘩𝘰𝘶𝘴𝘦 (𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘵𝘰𝘰𝘭𝘴) 𝘰𝘯 𝘢 𝘴𝘰𝘭𝘪𝘥 𝘧𝘰𝘶𝘯𝘥𝘢𝘵𝘪𝘰𝘯 (𝘚𝘉𝘖𝘔). 𝘞𝘪𝘵𝘩𝘰𝘶𝘵 𝘢 𝘴𝘵𝘶𝘳𝘥𝘺 𝘧𝘰𝘶𝘯𝘥𝘢𝘵𝘪𝘰𝘯, 𝘵𝘩𝘦 𝘩𝘰𝘶𝘴𝘦 𝘤𝘰𝘶𝘭𝘥 𝘦𝘢𝘴𝘪𝘭𝘺 𝘤𝘰𝘭𝘭𝘢𝘱𝘴𝘦. 𝘚𝘪𝘮𝘪𝘭𝘢𝘳𝘭𝘺, 𝘚𝘉𝘖𝘔𝘴 𝘱𝘳𝘰𝘷𝘪𝘥𝘦 𝘵𝘩𝘦 𝘦𝘴𝘴𝘦𝘯𝘵𝘪𝘢𝘭 𝘥𝘢𝘵𝘢 𝘵𝘩𝘢𝘵 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘵𝘰𝘰𝘭𝘴 𝘳𝘦𝘭𝘺 𝘰𝘯 𝘵𝘰 𝘪𝘥𝘦𝘯𝘵𝘪𝘧𝘺 𝘢𝘯𝘥 𝘮𝘪𝘵𝘪𝘨𝘢𝘵𝘦 𝘳𝘪𝘴𝘬𝘴 𝘦𝘧𝘧𝘦𝘤𝘵𝘪𝘷𝘦𝘭𝘺.


𝐎𝐯𝐞𝐫𝐯𝐢𝐞𝐰 𝐨𝐟 𝐍𝐓𝐈𝐀 𝐚𝐧𝐝 𝐒𝐁𝐎𝐌 𝐈𝐧𝐢𝐭𝐢𝐚𝐭𝐢𝐯𝐞𝐬

𝘛𝘩𝘦 𝘕𝘢𝘵𝘪𝘰𝘯𝘢𝘭 𝘛𝘦𝘭𝘦𝘤𝘰𝘮𝘮𝘶𝘯𝘪𝘤𝘢𝘵𝘪𝘰𝘯𝘴 𝘢𝘯𝘥 𝘐𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯 𝘈𝘥𝘮𝘪𝘯𝘪𝘴𝘵𝘳𝘢𝘵𝘪𝘰𝘯 (𝘕𝘛𝘐𝘈) 𝘪𝘴 𝘢 𝘜.𝘚. 𝘨𝘰𝘷𝘦𝘳𝘯𝘮𝘦𝘯𝘵 𝘢𝘨𝘦𝘯𝘤𝘺 𝘸𝘪𝘵𝘩𝘪𝘯 𝘵𝘩𝘦 𝘋𝘦𝘱𝘢𝘳𝘵𝘮𝘦𝘯𝘵 𝘰𝘧 𝘊𝘰𝘮𝘮𝘦𝘳𝘤𝘦, 𝘦𝘴𝘵𝘢𝘣𝘭𝘪𝘴𝘩𝘦𝘥 𝘵𝘰 𝘢𝘥𝘷𝘪𝘴𝘦 𝘰𝘯 𝘵𝘦𝘭𝘦𝘤𝘰𝘮𝘮𝘶𝘯𝘪𝘤𝘢𝘵𝘪𝘰𝘯𝘴 𝘢𝘯𝘥 𝘪𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯 𝘱𝘰𝘭𝘪𝘤𝘺 𝘪𝘴𝘴𝘶𝘦𝘴. 𝘛𝘩𝘦 𝘕𝘛𝘐𝘈'𝘴 𝘧𝘰𝘤𝘶𝘴 𝘪𝘯𝘤𝘭𝘶𝘥𝘦𝘴 𝘪𝘯𝘵𝘦𝘳𝘯𝘦𝘵 𝘱𝘰𝘭𝘪𝘤𝘺, 𝘣𝘳𝘰𝘢𝘥𝘣𝘢𝘯𝘥 𝘥𝘦𝘱𝘭𝘰𝘺𝘮𝘦𝘯𝘵, 𝘢𝘯𝘥 𝘱𝘶𝘣𝘭𝘪𝘤 𝘴𝘢𝘧𝘦𝘵𝘺 𝘤𝘰𝘮𝘮𝘶𝘯𝘪𝘤𝘢𝘵𝘪𝘰𝘯𝘴.

𝘐𝘯 𝘳𝘦𝘴𝘱𝘰𝘯𝘴𝘦 𝘵𝘰 𝘳𝘪𝘴𝘪𝘯𝘨 𝘤𝘺𝘣𝘦𝘳𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘵𝘩𝘳𝘦𝘢𝘵𝘴, 𝘗𝘳𝘦𝘴𝘪𝘥𝘦𝘯𝘵 𝘉𝘪𝘥𝘦𝘯 𝘪𝘴𝘴𝘶𝘦𝘥 𝘢𝘯 𝘌𝘹𝘦𝘤𝘶𝘵𝘪𝘷𝘦 𝘖𝘳𝘥𝘦𝘳 𝘰𝘯 𝘔𝘢𝘺 12, 2021, 𝘥𝘪𝘳𝘦𝘤𝘵𝘪𝘯𝘨 𝘵𝘩𝘦 𝘋𝘦𝘱𝘢𝘳𝘵𝘮𝘦𝘯𝘵 𝘰𝘧 𝘊𝘰𝘮𝘮𝘦𝘳𝘤𝘦 𝘵𝘰 𝘱𝘶𝘣𝘭𝘪𝘴𝘩 𝘵𝘩𝘦 "𝘮𝘪𝘯𝘪𝘮𝘶𝘮 𝘦𝘭𝘦𝘮𝘦𝘯𝘵𝘴" 𝘧𝘰𝘳 𝘢 𝘚𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘉𝘪𝘭𝘭 𝘰𝘧 𝘔𝘢𝘵𝘦𝘳𝘪𝘢𝘭𝘴 (𝘚𝘉𝘖𝘔). 𝘛𝘩𝘪𝘴 𝘮𝘰𝘷𝘦 𝘢𝘪𝘮𝘴 𝘵𝘰 𝘦𝘯𝘩𝘢𝘯𝘤𝘦 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘵𝘳𝘢𝘯𝘴𝘱𝘢𝘳𝘦𝘯𝘤𝘺 𝘢𝘯𝘥 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺, 𝘥𝘳𝘪𝘷𝘦𝘯 𝘣𝘺 𝘵𝘩𝘦 𝘯𝘦𝘦𝘥 𝘵𝘰 𝘮𝘢𝘯𝘢𝘨𝘦 𝘷𝘶𝘭𝘯𝘦𝘳𝘢𝘣𝘪𝘭𝘪𝘵𝘪𝘦𝘴 𝘢𝘯𝘥 𝘴𝘶𝘱𝘱𝘭𝘺 𝘤𝘩𝘢𝘪𝘯 𝘳𝘪𝘴𝘬𝘴 𝘮𝘰𝘳𝘦 𝘦𝘧𝘧𝘦𝘤𝘵𝘪𝘷𝘦𝘭𝘺.


𝑾𝒉𝒂𝒕 𝒊𝒔 𝑺𝑩𝑶𝑴 ?

𝘈𝘯 𝘚𝘉𝘖𝘔 𝘪𝘴 𝘢 𝘧𝘰𝘳𝘮𝘢𝘭 𝘳𝘦𝘤𝘰𝘳𝘥 𝘤𝘰𝘯𝘵𝘢𝘪𝘯𝘪𝘯𝘨 𝘵𝘩𝘦 𝘥𝘦𝘵𝘢𝘪𝘭𝘴 𝘢𝘯𝘥 𝘴𝘶𝘱𝘱𝘭𝘺 𝘤𝘩𝘢𝘪𝘯 𝘳𝘦𝘭𝘢𝘵𝘪𝘰𝘯𝘴𝘩𝘪𝘱𝘴 𝘰𝘧 𝘷𝘢𝘳𝘪𝘰𝘶𝘴 𝘤𝘰𝘮𝘱𝘰𝘯𝘦𝘯𝘵𝘴 𝘶𝘴𝘦𝘥 𝘪𝘯 𝘣𝘶𝘪𝘭𝘥𝘪𝘯𝘨 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦.

𝘚𝘉𝘖𝘔 𝘸𝘪𝘭𝘭 𝘯𝘰𝘵 𝘴𝘰𝘭𝘷𝘦 𝘢𝘭𝘭 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘱𝘳𝘰𝘣𝘭𝘦𝘮𝘴, 𝘣𝘶𝘵 𝘸𝘪𝘭𝘭 𝘧𝘰𝘳𝘮 𝘢 𝘧𝘰𝘶𝘯𝘥𝘢𝘵𝘪𝘰𝘯𝘢𝘭 𝘥𝘢𝘵𝘢 𝘭𝘢𝘺𝘦𝘳 𝘰𝘯 𝘸𝘩𝘪𝘤𝘩 𝘧𝘶𝘳𝘵𝘩𝘦𝘳 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘵𝘰𝘰𝘭𝘴, 𝘱𝘳𝘢𝘤𝘵𝘪𝘤𝘦𝘴, 𝘢𝘯𝘥 𝘢𝘴𝘴𝘶𝘳𝘢𝘯𝘤𝘦𝘴 𝘤𝘢𝘯 𝘣𝘦 𝘣𝘶𝘪𝘭𝘵.

𝘛𝘩𝘦 𝘮𝘪𝘯𝘪𝘮𝘶𝘮 𝘦𝘭𝘦𝘮𝘦𝘯𝘵𝘴 𝘢𝘴 𝘥𝘦𝘧𝘪𝘯𝘦𝘥 𝘪𝘯 𝘵𝘩𝘪𝘴 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵 𝘢𝘳𝘦 𝘵𝘩𝘦 𝘦𝘴𝘴𝘦𝘯𝘵𝘪𝘢𝘭 𝘱𝘪𝘦𝘤𝘦𝘴 𝘵𝘩𝘢𝘵 𝘴𝘶𝘱𝘱𝘰𝘳𝘵 𝘣𝘢𝘴𝘪𝘤 𝘚𝘉𝘖𝘔 𝘧𝘶𝘯𝘤𝘵𝘪𝘰𝘯𝘢𝘭𝘪𝘵𝘺 𝘢𝘯𝘥 𝘸𝘪𝘭𝘭 𝘴𝘦𝘳𝘷𝘦 𝘢𝘴 𝘵𝘩𝘦 𝘧𝘰𝘶𝘯𝘥𝘢𝘵𝘪𝘰𝘯 𝘧𝘰𝘳 𝘢𝘯 𝘦𝘷𝘰𝘭𝘷𝘪𝘯𝘨 𝘢𝘱𝘱𝘳𝘰𝘢𝘤𝘩 𝘵𝘰 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘵𝘳𝘢𝘯𝘴𝘱𝘢𝘳𝘦𝘯𝘤𝘺.

𝘛𝘩𝘦𝘴𝘦 𝘮𝘪𝘯𝘪𝘮𝘶𝘮 𝘦𝘭𝘦𝘮𝘦𝘯𝘵𝘴 𝘥𝘦𝘧𝘪𝘯𝘦𝘥 𝘣𝘺 𝘕𝘛𝘐𝘈 𝘧𝘰𝘳 𝘚𝘉𝘖𝘔𝘴 𝘢𝘳𝘦 𝘤𝘰𝘮𝘱𝘳𝘪𝘴𝘦 𝘵𝘩𝘳𝘦𝘦 𝘣𝘳𝘰𝘢𝘥, 𝘪𝘯𝘵𝘦𝘳𝘳𝘦𝘭𝘢𝘵𝘦𝘥 𝘢𝘳𝘦𝘢𝘴.


𝐍𝐓𝐈𝐀 𝐌𝐢𝐧𝐢𝐦𝐮𝐦 𝐄𝐥𝐞𝐦𝐞𝐧𝐭𝐬 𝐟𝐨𝐫 𝐒𝐁𝐎𝐌𝐬

1. 𝐃𝐚𝐭𝐚 𝐅𝐢𝐞𝐥𝐝𝐬

  • Component Name: 𝘐𝘥𝘦𝘯𝘵𝘪𝘧𝘪𝘦𝘴 𝘵𝘩𝘦 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘶𝘯𝘪𝘵, 𝘦.𝘨., "𝘭𝘪𝘣𝘟𝘠𝘡."

  • Version: 𝘚𝘱𝘦𝘤𝘪𝘧𝘪𝘦𝘴 𝘵𝘩𝘦 𝘤𝘩𝘢𝘯𝘨𝘦 𝘪𝘯 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦, 𝘦.𝘨., "𝘷2.1."

  • Supplier: 𝘖𝘳𝘪𝘨𝘪𝘯 𝘰𝘧 𝘵𝘩𝘦 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦, 𝘦.𝘨., "𝘈𝘤𝘮𝘦 𝘊𝘰𝘳𝘱."

  • Unique Identifiers: 𝘐𝘥𝘦𝘯𝘵𝘪𝘧𝘪𝘦𝘳𝘴 𝘭𝘪𝘬𝘦 𝘊𝘗𝘌, 𝘚𝘞𝘐𝘋 𝘵𝘢𝘨𝘴, 𝘗𝘜𝘙𝘓.

  • Dependency Relationship: 𝘚𝘩𝘰𝘸𝘴 𝘩𝘰𝘸 𝘤𝘰𝘮𝘱𝘰𝘯𝘦𝘯𝘵𝘴 𝘪𝘯𝘵𝘦𝘳𝘢𝘤𝘵.

  • Author of SBOM Data: 𝘊𝘳𝘦𝘢𝘵𝘰𝘳 𝘰𝘧 𝘵𝘩𝘦 𝘚𝘉𝘖𝘔.

  • Timestamp: 𝘞𝘩𝘦𝘯 𝘵𝘩𝘦 𝘚𝘉𝘖𝘔 𝘸𝘢𝘴 𝘤𝘳𝘦𝘢𝘵𝘦𝘥.

𝐄𝐱𝐚𝐦𝐩𝐥𝐞: Just like a recipe lists ingredients (data fields), an SBOM lists components, ensuring that everything needed to understand the software is documented.

2. 𝐀𝐮𝐭𝐨𝐦𝐚𝐭𝐢𝐨𝐧 𝐒𝐮𝐩𝐩𝐨𝐫𝐭

𝘋𝘢𝘵𝘢 𝘧𝘰𝘳𝘮𝘢𝘵𝘴 𝘶𝘴𝘦𝘥 𝘵𝘰 𝘨𝘦𝘯𝘦𝘳𝘢𝘵𝘦 𝘢𝘯𝘥 𝘤𝘰𝘯𝘴𝘶𝘮𝘦 𝘚𝘉𝘖𝘔𝘴:

  • 𝘚𝘗𝘋𝘟,

  • 𝘊𝘺𝘤𝘭𝘰𝘯𝘦𝘋𝘟, 𝘢𝘯𝘥

  • 𝘚𝘞𝘐𝘋 𝘵𝘢𝘨𝘴.

𝐄𝐱𝐚𝐦𝐩𝐥𝐞: 𝘜𝘴𝘪𝘯𝘨 𝘮𝘢𝘤𝘩𝘪𝘯𝘦-𝘳𝘦𝘢𝘥𝘢𝘣𝘭𝘦 𝘧𝘰𝘳𝘮𝘢𝘵𝘴 (𝘚𝘗𝘋𝘟, 𝘊𝘺𝘤𝘭𝘰𝘯𝘦𝘋𝘟, 𝘚𝘞𝘐𝘋 𝘵𝘢𝘨𝘴) 𝘪𝘴 𝘭𝘪𝘬𝘦 𝘶𝘴𝘪𝘯𝘨 𝘣𝘢𝘳𝘤𝘰𝘥𝘦𝘴 𝘪𝘯 𝘢 𝘴𝘶𝘱𝘦𝘳𝘮𝘢𝘳𝘬𝘦𝘵, 𝘢𝘭𝘭𝘰𝘸𝘪𝘯𝘨 𝘧𝘰𝘳 𝘲𝘶𝘪𝘤𝘬 𝘢𝘯𝘥 𝘢𝘤𝘤𝘶𝘳𝘢𝘵𝘦 𝘴𝘤𝘢𝘯𝘯𝘪𝘯𝘨 𝘰𝘧 𝘱𝘳𝘰𝘥𝘶𝘤𝘵𝘴 (𝘤𝘰𝘮𝘱𝘰𝘯𝘦𝘯𝘵𝘴).

3. 𝐏𝐫𝐚𝐜𝐭𝐢𝐜𝐞𝐬 𝐚𝐧𝐝 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐞𝐬

  • Frequency: 𝘜𝘱𝘥𝘢𝘵𝘦 𝘚𝘉𝘖𝘔 𝘸𝘪𝘵𝘩 𝘯𝘦𝘸 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘷𝘦𝘳𝘴𝘪𝘰𝘯𝘴.

  • Depth: 𝘐𝘯𝘤𝘭𝘶𝘥𝘦 𝘢𝘭𝘭 𝘵𝘰𝘱-𝘭𝘦𝘷𝘦𝘭 𝘤𝘰𝘮𝘱𝘰𝘯𝘦𝘯𝘵𝘴 𝘢𝘯𝘥 𝘥𝘦𝘱𝘦𝘯𝘥𝘦𝘯𝘤𝘪𝘦𝘴.

  • Known Unknowns: 𝘈𝘤𝘬𝘯𝘰𝘸𝘭𝘦𝘥𝘨𝘦 𝘢𝘯𝘺 𝘶𝘯𝘴𝘱𝘦𝘤𝘪𝘧𝘪𝘦𝘥 𝘥𝘦𝘱𝘦𝘯𝘥𝘦𝘯𝘤𝘪𝘦𝘴.

  • Distribution and Delivery: 𝘌𝘯𝘴𝘶𝘳𝘦 𝘵𝘪𝘮𝘦𝘭𝘺 𝘢𝘷𝘢𝘪𝘭𝘢𝘣𝘪𝘭𝘪𝘵𝘺.

  • Access Control: 𝘔𝘢𝘯𝘢𝘨𝘦 𝘱𝘦𝘳𝘮𝘪𝘴𝘴𝘪𝘰𝘯𝘴 𝘢𝘱𝘱𝘳𝘰𝘱𝘳𝘪𝘢𝘵𝘦𝘭𝘺.

  • Accommodation of Mistakes: 𝘈𝘭𝘭𝘰𝘸 𝘧𝘰𝘳 𝘦𝘳𝘳𝘰𝘳 𝘤𝘰𝘳𝘳𝘦𝘤𝘵𝘪𝘰𝘯.

𝐄𝐱𝐚𝐦𝐩𝐥𝐞: 𝘙𝘦𝘨𝘶𝘭𝘢𝘳 𝘮𝘢𝘪𝘯𝘵𝘦𝘯𝘢𝘯𝘤𝘦 𝘰𝘧 𝘺𝘰𝘶𝘳 𝘤𝘢𝘳 (𝘧𝘳𝘦𝘲𝘶𝘦𝘯𝘤𝘺) 𝘢𝘯𝘥 𝘶𝘴𝘪𝘯𝘨 𝘨𝘦𝘯𝘶𝘪𝘯𝘦 𝘱𝘢𝘳𝘵𝘴 (𝘥𝘦𝘱𝘵𝘩) 𝘦𝘯𝘴𝘶𝘳𝘦𝘴 𝘪𝘵𝘴 𝘳𝘦𝘭𝘪𝘢𝘣𝘪𝘭𝘪𝘵𝘺, 𝘴𝘪𝘮𝘪𝘭𝘢𝘳 𝘵𝘰 𝘩𝘰𝘸 𝘚𝘉𝘖𝘔 𝘱𝘳𝘢𝘤𝘵𝘪𝘤𝘦𝘴 𝘮𝘢𝘪𝘯𝘵𝘢𝘪𝘯 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘪𝘯𝘵𝘦𝘨𝘳𝘪𝘵𝘺.

𝐁𝐞𝐧𝐞𝐟𝐢𝐭𝐬 𝐨𝐟 𝐒𝐁𝐎𝐌𝐬

Transparency

• 𝐄𝐱𝐚𝐦𝐩𝐥𝐞: 𝘓𝘪𝘬𝘦 𝘢 𝘯𝘶𝘵𝘳𝘪𝘵𝘪𝘰𝘯 𝘭𝘢𝘣𝘦𝘭 𝘰𝘯 𝘧𝘰𝘰𝘥 𝘱𝘳𝘰𝘥𝘶𝘤𝘵𝘴, 𝘢𝘯 𝘚𝘉𝘖𝘔 𝘱𝘳𝘰𝘷𝘪𝘥𝘦𝘴 𝘷𝘪𝘴𝘪𝘣𝘪𝘭𝘪𝘵𝘺 𝘪𝘯𝘵𝘰 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘤𝘰𝘮𝘱𝘰𝘯𝘦𝘯𝘵𝘴, 𝘩𝘦𝘭𝘱𝘪𝘯𝘨 𝘶𝘴𝘦𝘳𝘴 𝘮𝘢𝘬𝘦 𝘪𝘯𝘧𝘰𝘳𝘮𝘦𝘥 𝘥𝘦𝘤𝘪𝘴𝘪𝘰𝘯𝘴.

Vulnerability Management

• 𝐄𝐱𝐚𝐦𝐩𝐥𝐞: 𝘐𝘧 𝘢 𝘴𝘱𝘦𝘤𝘪𝘧𝘪𝘤 𝘤𝘢𝘳 𝘱𝘢𝘳𝘵 𝘪𝘴 𝘳𝘦𝘤𝘢𝘭𝘭𝘦𝘥, 𝘬𝘯𝘰𝘸𝘪𝘯𝘨 𝘸𝘩𝘪𝘤𝘩 𝘮𝘰𝘥𝘦𝘭𝘴 𝘶𝘴𝘦 𝘵𝘩𝘢𝘵 𝘱𝘢𝘳𝘵 (𝘷𝘶𝘭𝘯𝘦𝘳𝘢𝘣𝘪𝘭𝘪𝘵𝘺 𝘮𝘢𝘯𝘢𝘨𝘦𝘮𝘦𝘯𝘵) 𝘢𝘭𝘭𝘰𝘸𝘴 𝘧𝘰𝘳 𝘲𝘶𝘪𝘤𝘬 𝘢𝘤𝘵𝘪𝘰𝘯, 𝘫𝘶𝘴𝘵 𝘢𝘴 𝘚𝘉𝘖𝘔𝘴 𝘩𝘦𝘭𝘱 𝘲𝘶𝘪𝘤𝘬𝘭𝘺 𝘢𝘥𝘥𝘳𝘦𝘴𝘴 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘷𝘶𝘭𝘯𝘦𝘳𝘢𝘣𝘪𝘭𝘪𝘵𝘪𝘦𝘴.

Supply Chain Security

• 𝐄𝐱𝐚𝐦𝐩𝐥𝐞: 𝘛𝘳𝘢𝘤𝘬𝘪𝘯𝘨 𝘵𝘩𝘦 𝘰𝘳𝘪𝘨𝘪𝘯 𝘰𝘧 𝘦𝘢𝘤𝘩 𝘪𝘯𝘨𝘳𝘦𝘥𝘪𝘦𝘯𝘵 𝘪𝘯 𝘢 𝘥𝘪𝘴𝘩 𝘦𝘯𝘴𝘶𝘳𝘦𝘴 𝘧𝘰𝘰𝘥 𝘴𝘢𝘧𝘦𝘵𝘺, 𝘫𝘶𝘴𝘵 𝘢𝘴 𝘚𝘉𝘖𝘔𝘴 𝘵𝘳𝘢𝘤𝘬 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘤𝘰𝘮𝘱𝘰𝘯𝘦𝘯𝘵𝘴 𝘵𝘰 𝘴𝘦𝘤𝘶𝘳𝘦 𝘵𝘩𝘦 𝘴𝘶𝘱𝘱𝘭𝘺 𝘤𝘩𝘢𝘪𝘯.

𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐅𝐮𝐭𝐮𝐫𝐞 𝐖𝐨𝐫𝐤

  • 𝘊𝘶𝘳𝘳𝘦𝘯𝘵 𝘜𝘴𝘦: 𝘖𝘳𝘨𝘢𝘯𝘪𝘻𝘢𝘵𝘪𝘰𝘯𝘴 𝘢𝘳𝘦 𝘢𝘥𝘰𝘱𝘵𝘪𝘯𝘨 𝘚𝘉𝘖𝘔𝘴, 𝘣𝘶𝘵 𝘮𝘰𝘳𝘦 𝘸𝘰𝘳𝘬 𝘪𝘴 𝘯𝘦𝘦𝘥𝘦𝘥 𝘵𝘰 𝘤𝘰𝘷𝘦𝘳 𝘵𝘩𝘦 𝘦𝘯𝘵𝘪𝘳𝘦 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘭𝘪𝘧𝘦𝘤𝘺𝘤𝘭𝘦.

  • 𝘊𝘩𝘢𝘭𝘭𝘦𝘯𝘨𝘦𝘴: 𝘚𝘉𝘖𝘔𝘴 𝘸𝘰𝘯'𝘵 𝘴𝘰𝘭𝘷𝘦 𝘢𝘭𝘭 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘪𝘴𝘴𝘶𝘦𝘴, 𝘦𝘴𝘱𝘦𝘤𝘪𝘢𝘭𝘭𝘺 𝘵𝘩𝘰𝘴𝘦 𝘵𝘢𝘳𝘨𝘦𝘵𝘪𝘯𝘨 𝘥𝘦𝘷𝘦𝘭𝘰𝘱𝘮𝘦𝘯𝘵 𝘵𝘰𝘰𝘭𝘴 𝘢𝘯𝘥 𝘴𝘺𝘴𝘵𝘦𝘮𝘴.

  • 𝘍𝘶𝘵𝘶𝘳𝘦 𝘍𝘰𝘤𝘶𝘴: 𝘌𝘯𝘩𝘢𝘯𝘤𝘪𝘯𝘨 𝘮𝘦𝘵𝘢𝘥𝘢𝘵𝘢 𝘤𝘢𝘱𝘵𝘶𝘳𝘦, 𝘢𝘶𝘵𝘰𝘮𝘢𝘵𝘪𝘰𝘯, 𝘢𝘯𝘥 𝘴𝘵𝘢𝘯𝘥𝘢𝘳𝘥𝘪𝘻𝘢𝘵𝘪𝘰𝘯 𝘧𝘰𝘳 𝘣𝘦𝘵𝘵𝘦𝘳 𝘮𝘢𝘤𝘩𝘪𝘯𝘦 𝘳𝘦𝘢𝘥𝘢𝘣𝘪𝘭𝘪𝘵𝘺 𝘢𝘯𝘥 𝘱𝘰𝘭𝘪𝘤𝘺 𝘦𝘯𝘧𝘰𝘳𝘤𝘦𝘮𝘦𝘯𝘵.

𝐄𝐱𝐚𝐦𝐩𝐥𝐞: 𝘞𝘩𝘪𝘭𝘦 𝘩𝘢𝘷𝘪𝘯𝘨 𝘢 𝘥𝘦𝘵𝘢𝘪𝘭𝘦𝘥 𝘮𝘢𝘱 (𝘤𝘶𝘳𝘳𝘦𝘯𝘵 𝘶𝘴𝘦) 𝘪𝘴 𝘩𝘦𝘭𝘱𝘧𝘶𝘭, 𝘶𝘱𝘥𝘢𝘵𝘪𝘯𝘨 𝘪𝘵 𝘸𝘪𝘵𝘩 𝘳𝘦𝘢𝘭-𝘵𝘪𝘮𝘦 𝘵𝘳𝘢𝘧𝘧𝘪𝘤 𝘥𝘢𝘵𝘢 (𝘧𝘶𝘵𝘶𝘳𝘦 𝘧𝘰𝘤𝘶𝘴) 𝘮𝘢𝘬𝘦𝘴 𝘯𝘢𝘷𝘪𝘨𝘢𝘵𝘪𝘰𝘯 (𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺) 𝘦𝘷𝘦𝘯 𝘮𝘰𝘳𝘦 𝘦𝘧𝘧𝘦𝘤𝘵𝘪𝘷𝘦.

𝐒𝐮𝐦𝐦𝐚𝐫𝐲

𝘚𝘉𝘖𝘔𝘴 𝘱𝘳𝘰𝘷𝘪𝘥𝘦 𝘦𝘴𝘴𝘦𝘯𝘵𝘪𝘢𝘭 𝘵𝘳𝘢𝘯𝘴𝘱𝘢𝘳𝘦𝘯𝘤𝘺 𝘢𝘯𝘥 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘧𝘰𝘳 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦, 𝘭𝘪𝘴𝘵𝘪𝘯𝘨 𝘤𝘰𝘮𝘱𝘰𝘯𝘦𝘯𝘵𝘴 𝘢𝘯𝘥 𝘵𝘩𝘦𝘪𝘳 𝘳𝘦𝘭𝘢𝘵𝘪𝘰𝘯𝘴𝘩𝘪𝘱𝘴. 𝘛𝘩𝘦𝘺 𝘩𝘦𝘭𝘱 𝘮𝘢𝘯𝘢𝘨𝘦 𝘷𝘶𝘭𝘯𝘦𝘳𝘢𝘣𝘪𝘭𝘪𝘵𝘪𝘦𝘴 𝘢𝘯𝘥 𝘴𝘶𝘱𝘱𝘭𝘺 𝘤𝘩𝘢𝘪𝘯 𝘳𝘪𝘴𝘬𝘴, 𝘧𝘰𝘳𝘮𝘪𝘯𝘨 𝘢 𝘤𝘳𝘪𝘵𝘪𝘤𝘢𝘭 𝘴𝘵𝘦𝘱 𝘵𝘰𝘸𝘢𝘳𝘥 𝘴𝘦𝘤𝘶𝘳𝘪𝘯𝘨 𝘵𝘩𝘦 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘦𝘤𝘰𝘴𝘺𝘴𝘵𝘦𝘮. 𝘉𝘺 𝘪𝘮𝘱𝘭𝘦𝘮𝘦𝘯𝘵𝘪𝘯𝘨 𝘚𝘉𝘖𝘔𝘴, 𝘰𝘳𝘨𝘢𝘯𝘪𝘻𝘢𝘵𝘪𝘰𝘯𝘴 𝘤𝘢𝘯 𝘦𝘯𝘴𝘶𝘳𝘦 𝘮𝘰𝘳𝘦 𝘴𝘦𝘤𝘶𝘳𝘦 𝘢𝘯𝘥 𝘳𝘦𝘭𝘪𝘢𝘣𝘭𝘦 𝘴𝘰𝘧𝘵𝘸𝘢𝘳𝘦 𝘥𝘦𝘷𝘦𝘭𝘰𝘱𝘮𝘦𝘯𝘵 𝘢𝘯𝘥 𝘥𝘦𝘱𝘭𝘰𝘺𝘮𝘦𝘯𝘵.

𝘍𝘰𝘳 𝘮𝘰𝘳𝘦 𝘥𝘦𝘵𝘢𝘪𝘭𝘦𝘥 𝘪𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯, 𝘺𝘰𝘶 𝘤𝘢𝘯 𝘳𝘦𝘢𝘥 𝘵𝘩𝘦 𝘧𝘶𝘭𝘭 𝘕𝘛𝘐𝘈 𝘳𝘦𝘱𝘰𝘳𝘵 𝘩𝘦𝘳𝘦. 

Comments

Post a Comment

All Post

Logging ??

Image
 Today we will learn about the following things: What is logging ?? Why do we need logging ?? How can logging help us ?? Why suddenly from the last 5-10 years logging has been evolving ?? Logging tools ?? First thing first, let's start with logging. Logging is human-readable information that is primarily text in nature. Logging is triggered or generated when some kind of event occurs, such event is known as a log event.  Each logging message contains the timestamp, which signifies the time at which the event occurred. Now let, us understand why we need logging.  Importance of logging ?? In today's world software all around the world captures the whole market. By definition, Software is a program that is made up of millions of lines of code.  The programmer while writing the code adds the logs at all places to know the code behaviors as well as unexpected ones.  The logs can be of types such as ERROR, WARN, INFO, FATAL, DEBUG, TRACE, etc.     NOTE : Logs are also added to know w
Read more

Argo CD 101

Image
Why Argo CD ?? Because it fulfills all the points of the GitOps principle . As it extends the benefits of declarative specifications, acting as a GitOps Operator, follows a pull-based approach,  and considers Git as a source of truth for configuration management. It follows a pattern of reconciliation i.e. continuously performing a control loop every 3 minutes to achieve the desired state by fetching the desired configuration from Git. Let’s understand it in more detail, how can we achieve or implement GitOps using Argo CD ?? We all know that every company and every developer uses Git as a source code management software to store code. Developers can commit their infrastructure configurations, such as Kubernetes resource manifest, in Git to create the environment needed for application deployment. Once a developer implements a feature( with new applications and Kubernetes configurations) and merges the main branch. With the help of the GitOps agent or GitOps operator, Argo CD will imme
Read more

What is GitOps in easy way ??

Image
Here we will discuss: "What is GitOps", and "What are its 4 important principles". And lastly, "Why GitOps operator follow a pull-based model ?". What is GitOps ?? GitOps is made up of two words: Git and Ops . Git is where you keep your desired manifest(or configurations) that you want to deploy in your cluster(or environment). And Ops refers to Operation. Operation refers to the environment where the things are operated to ensure that the actual state or live state of that environment must be the same as the desired state in the git. To achieve that from the actual state to the desired state an operation is performed inside the environment.  Such an environment could be a Kubernetes cluster. So, anything that you want to deploy in the Kubernetes simply put it in the git. From git, the GitOps operator(i.e. Argo CD) will deploy to the Kubernetes cluster. To understand the GitOps better we need to understand 4 principles of it: 4 Principles of GitOps: 1.
Read more

Why need of Cloud Computing ??

Image
  Do you recall the result day of your class 10th and 12th? I believe you do. One thing that caught everyone's attention was the server being down when you accessed the website to check the results. Have you ever wondered why the server experienced downtime?   What was the underlying reason for it? Before we proceed, it's essential to grasp the concept of  servers  and  requests . A server can be a single laptop/computer/node or a cluster of laptops/computers that offer specific services. In this scenario, the server was responsible for running the CBSE   board website through which you could access your results. And second thing it was publicly accessible from the Internet. Another important aspect to consider is the concept of a request. A request is like a command that initiates the execution of a program. When you enter your roll number , name , etc., and press the submit button, it counts as one request. This request is sent to the server, prompting it to execute the
Read more

AWS and its Services ??

Image
So, in a previous blog, we learned about cloud computing and its importance . Here we will start with the popular cloud service provider, Amazon Web Services(AWS).  AWS or Amazon Web Services is a cloud service provider that offers various cloud computing services that are accessible via the public internet. The popular services provided by AWS are:  Virtual machine(EC2),  Virtual Network(VPC), Restrict access to cloud resources(IAM), etc.  Executing functions(Lambda),  Automating your infrastructure(CloudFormation),  Object Storage(S3),  Block Storage for Virtual Machines(EBS),  Running and Managing Containers(ECS and fargate),  Network Filesystem(EBS),  SQL database(RDS),    Load Balancer(ELB),   Monitoring and logging(CloudWatch),  We will learn these services one by one.  In this blog, we will cover Virtual Machines (EC2). These services can be accessed in four ways: Console :  access AWS services through a graphical user interface (GUI) CLI :    to manage and access AWS services
Read more

Build a Slack activity dashboard with Metabase

Image
Introduction In this article, we will be leveraging Airbyte - an open-source data integration platform and Metabase - an open-source way for everyone in your company to ask questions and learn from data - to build the Slack activity dashboard above. Airbyte provides us with a rich set of source connectors, and one of those is the Slack connector which allows us to get data off a Slack. We are going to use this connector to get the data of the Slack Workspace and copy them into a Postgres database destination. And then will connect Postgres database with Metabase in order to create the activity dashboard. Pre-requisites: Git Docker Docker Compose Airbyte Postgres Database Metabase Slack Step 1: Replicating data from Slack to Postgres with Airbyte Deploying Airbyte There are several easy ways to deploy Airbyte, as listed here. For this tutorial, I will just use the Docker Compose method from my workstation:  ``` $ git clone https://github.com/airbytehq/airbyte.git $ cd airbyte $ docke
Read more

Prometheus Architecture...

Image
  Prometheus Architecture Look at the below figure, and we can see that Prometheus has major 3 things:  to pull Metrics ,  store it in the Time-Series database , a nd  allow third parties to retrieve metrics using PromQL Metrics are mainly pulled from 3 sources: PushGateway , Exporters , and Instrumentation . These pulled metrics are then stored in a time-series database. Later time-series stored metrics are used by third parties such as Prometheus Web UI ,  Alertmanager , and Grafana . Components of Prometheus: There are 3 main components of Prometheus: Retrieval/Pull Metrics This component of Prometheus is mainly responsible for pulling metrics from targets. Targets can be exporters ,   instrumentation , and pushgateway . Time Series Database Once the retrieval collects data from the target, then it transfers to a time-series database. The data are stored in the form of a metric. Each metric is identified by its name and labels. HTTP Server It allows collected time-series data from
Read more

Observability 101

Image
Hey Everyone !! Good to see you all here to learn Prometheus. This blog is the prerequisite to learning Prometheus.  Prometheus is a part of Observability. Before wasting our time, let's jump into the topic called Observability. Observability Fundamentals What is Observability ?? Observability == Observe + Ability. Observability is made up of 2 words: Observe and Ability .  Observe means to observe the data generated from the system, and the ability  means to measure and understand the system's state based on the generated data.  In the broader sense, Observability gives you the insight of the system's internal working of each component. And that helps while troubleshooting an issue. From where does the concept of Observability come in?? In the early days when applications were deployed in Monolithic structures, humans were able to monitor each component present in the system/server due to the limited number of components. As the microservice application started to boom,
Read more

Monitoring 101

What is Monitoring ?? Monitoring refers to a tool that collects metrics data, provides a dashboard to visualize the collected data, and generates alerts based on alerting rules.  Monitoring tool =~ Metrics + Visualization + Alerting Monitoring can be done in 2 ways: Blackbox Monitoring Whitebox Monitoring BlackBox Monitoring In this type of monitoring, Applications or Systems are monitored/observed from outside via APIs.  Whitebox Monitoring In this type of monitoring, Applications or Systems are monitored or observed from inside. Here, the system itself is under observation which exposes its internal state data and performance data of the system. This type of internal introspection is very powerful because it exposes the operating system telemetry and the health of each different internal component.  So after collecting internal state data, now we need to know,  what are different ways to expose or send these data ? There are 3 different ways to expose the data: Exported through loggi
Read more

Computer Networking 101

Image
Hello Everyone !! I hope you are doing well. We all know the importance of the Internet world. But how does that happen? In the series on Computer Networking we will learn the following topics: What is the Client-Server model? What is Internet Protocol? How does our device connect to Wi-Fi or Hotspot? What happens when you search for www.google.com , www.facebook.com , www.amazon.com , www.linkedin.com , www.github.com , www.youtube.com ,etc?
Read more