Understanding NTIA's Minimum Elements for SBOMs: A Comprehensive Guide

 



Purpose

SBOMs provides the foundation for transparency in software supply chain.


Overview of NTIA and SBOM Intiatives

The National Telecommunications and Information Administration(NTIA) is a U.S. government agency within the Department of Commerce, established to advise on telecommunication and information policy issue.
In response to rising software supply chain threats, President Biden signed an Executive Order  in 2021. This step taken to being the "minimum elements" for a Software Bill Of Materials(SBOM).  The motive behind the initiative to bring a transparency in the complex modern software world.


What is SBOM ?

An SBOM is detailed description of all the dependencies on which your main software relies on. It provides two important information. One is supply chain relationship for your software. To be more precise, it let you know what all are the dependencies are present in your software. Second is information of each dependency in detail. From it's name, version, license, supplier name, author name, unique IDs, etc.


How SBOM is important from security point of view ?

Above we discuss two important information data provided via SBOM. These information provides an insights of it. Using these insights, one can take action from possible risks present in the dependencies.


Why SBOM Compliance ?

The US government realized that, they consumes lots of software. But hardly aware of what they consume. In modern world software are highly dependent on third parties open source libraries. And it becomes an in-effecient job for an organization to go through tons of dependencies and mitigates the possible risks lurking behind it. Government emphasize that to keep eye on these dependencies and mitigate possible risks, we need some important information of these dependencies. So, they brought up SBOM compliance for US govt, which is "minimum element". The minimum elements contains required field for each dependency  and as well as for SBOM document.


NTIA Minimum Elements for SBOMs

1. Data Fields

  • Component Name: Identifies of the Software unit, e.g., "libXYZ"
  • Version: Specifies the change in software, e.g. v1.0.0
  • Supplier: Origin of Software, e.g "Acme Corp".
  • Unique Identifies: Identifies like CPE, PURL, SWID, etc.
  • Dependency Relationship: Shows how component interact.
  • Author of SBOM data: One who Created SBOM.
  • Timestamp: When was SBOM creator.
Example: Just like food packets list the ingredients at the back of the wrapper. Similarly, SBOM lists all the dependencies(i.e. components) required to make up the software.


2. Automation Support

Data format used for generate and consume SBOMs:
  • SPDX
  • CycloneDX
  • SWID
Example: These formats are machine-readable as well as human readable, which plays an important role in scalability. 


3. Practices and Process

  • Frequency: Update SBOM with new software versions.
  • Depth: Include all top-level component and dependencies.
  • Known Unknowns: Acknowledge any unspecified dependencies.
  • Distribution and Delivery: Ensure timely availability.
  • Access Control: Manage permission appropriately.
  • Accommodation of Mistakes : Allow for error correction.
Example: Regular maintenance of your car(frequency) and using genuine parts(depth) ensures its reliability, similar to how SBOM practices maintain software integrity.


Summary

SBOM provides essential transparency and security for software, listing components and their relationships. They help manage vulnerabilities and supply chain risks, forming a critical step toward securing the software ecosystem. By implementing SBOMs, organization can ensure and reliable software development and deployment. 
Read full NTIA report here.


Comments

Post a Comment

All Post

Argo CD 101

Image
Why Argo CD ?? Because it fulfills all the points of the GitOps principle . As it extends the benefits of declarative specifications, acting as a GitOps Operator, follows a pull-based approach,  and considers Git as a source of truth for configuration management. It follows a pattern of reconciliation i.e. continuously performing a control loop every 3 minutes to achieve the desired state by fetching the desired configuration from Git. Let’s understand it in more detail, how can we achieve or implement GitOps using Argo CD ?? We all know that every company and every developer uses Git as a source code management software to store code. Developers can commit their infrastructure configurations, such as Kubernetes resource manifest, in Git to create the environment needed for application deployment. Once a developer implements a feature( with new applications and Kubernetes configurations) and merges the main branch. With the help of the GitOps agent or GitOps operator, Argo CD will ...
Read more

Logging ??

Image
 Today we will learn about the following things: What is logging ?? Why do we need logging ?? How can logging help us ?? Why suddenly from the last 5-10 years logging has been evolving ?? Logging tools ?? First thing first, let's start with logging. Logging is human-readable information that is primarily text in nature. Logging is triggered or generated when some kind of event occurs, such event is known as a log event.  Each logging message contains the timestamp, which signifies the time at which the event occurred. Now let, us understand why we need logging.  Importance of logging ?? In today's world software all around the world captures the whole market. By definition, Software is a program that is made up of millions of lines of code.  The programmer while writing the code adds the logs at all places to know the code behaviors as well as unexpected ones.  The logs can be of types such as ERROR, WARN, INFO, FATAL, DEBUG, TRACE, etc. ...
Read more

What is GitOps in easy way ??

Image
Here we will discuss: "What is GitOps", and "What are its 4 important principles". And lastly, "Why GitOps operator follow a pull-based model ?". What is GitOps ?? GitOps is made up of two words: Git and Ops . Git is where you keep your desired manifest(or configurations) that you want to deploy in your cluster(or environment). And Ops refers to Operation. Operation refers to the environment where the things are operated to ensure that the actual state or live state of that environment must be the same as the desired state in the git. To achieve that from the actual state to the desired state an operation is performed inside the environment.  Such an environment could be a Kubernetes cluster. So, anything that you want to deploy in the Kubernetes simply put it in the git. From git, the GitOps operator(i.e. Argo CD) will deploy to the Kubernetes cluster. To understand the GitOps better we need to understand 4 principles of it: 4 Principles of GitOps: 1. ...
Read more

AWS and its Services ??

Image
So, in a previous blog, we learned about cloud computing and its importance . Here we will start with the popular cloud service provider, Amazon Web Services(AWS).  AWS or Amazon Web Services is a cloud service provider that offers various cloud computing services that are accessible via the public internet. The popular services provided by AWS are:  Virtual machine(EC2),  Virtual Network(VPC), Restrict access to cloud resources(IAM), etc.  Executing functions(Lambda),  Automating your infrastructure(CloudFormation),  Object Storage(S3),  Block Storage for Virtual Machines(EBS),  Running and Managing Containers(ECS and fargate),  Network Filesystem(EBS),  SQL database(RDS),    Load Balancer(ELB),   Monitoring and logging(CloudWatch),  We will learn these services one by one.  In this blog, we will cover Virtual Machines (EC2). These services can be accessed in four ways: Console :  access AWS serv...
Read more

Why need of Cloud Computing ??

Image
  Do you recall the result day of your class 10th and 12th? I believe you do. One thing that caught everyone's attention was the server being down when you accessed the website to check the results. Have you ever wondered why the server experienced downtime?   What was the underlying reason for it? Before we proceed, it's essential to grasp the concept of  servers  and  requests . A server can be a single laptop/computer/node or a cluster of laptops/computers that offer specific services. In this scenario, the server was responsible for running the CBSE   board website through which you could access your results. And second thing it was publicly accessible from the Internet. Another important aspect to consider is the concept of a request. A request is like a command that initiates the execution of a program. When you enter your roll number , name , etc., and press the submit button, it counts as one request. This request is sent to the server, prompti...
Read more

Build a Slack activity dashboard with Metabase

Image
Introduction In this article, we will be leveraging Airbyte - an open-source data integration platform and Metabase - an open-source way for everyone in your company to ask questions and learn from data - to build the Slack activity dashboard above. Airbyte provides us with a rich set of source connectors, and one of those is the Slack connector which allows us to get data off a Slack. We are going to use this connector to get the data of the Slack Workspace and copy them into a Postgres database destination. And then will connect Postgres database with Metabase in order to create the activity dashboard. Pre-requisites: Git Docker Docker Compose Airbyte Postgres Database Metabase Slack Step 1: Replicating data from Slack to Postgres with Airbyte Deploying Airbyte There are several easy ways to deploy Airbyte, as listed here. For this tutorial, I will just use the Docker Compose method from my workstation:  ``` $ git clone https://github.com/airbytehq/airbyte.git $ cd airbyte $ d...
Read more

Observability 101

Image
Hey Everyone !! Good to see you all here to learn Prometheus. This blog is the prerequisite to learning Prometheus.  Prometheus is a part of Observability. Before wasting our time, let's jump into the topic called Observability. Observability Fundamentals What is Observability ?? Observability == Observe + Ability. Observability is made up of 2 words: Observe and Ability .  Observe means to observe the data generated from the system, and the ability  means to measure and understand the system's state based on the generated data.  In the broader sense, Observability gives you the insight of the system's internal working of each component. And that helps while troubleshooting an issue. From where does the concept of Observability come in?? In the early days when applications were deployed in Monolithic structures, humans were able to monitor each component present in the system/server due to the limited number of components. As the microservice application started t...
Read more

Prometheus Architecture...

Image
  Prometheus Architecture Look at the below figure, and we can see that Prometheus has major 3 things:  to pull Metrics ,  store it in the Time-Series database , a nd  allow third parties to retrieve metrics using PromQL Metrics are mainly pulled from 3 sources: PushGateway , Exporters , and Instrumentation . These pulled metrics are then stored in a time-series database. Later time-series stored metrics are used by third parties such as Prometheus Web UI ,  Alertmanager , and Grafana . Components of Prometheus: There are 3 main components of Prometheus: Retrieval/Pull Metrics This component of Prometheus is mainly responsible for pulling metrics from targets. Targets can be exporters ,   instrumentation , and pushgateway . Time Series Database Once the retrieval collects data from the target, then it transfers to a time-series database. The data are stored in the form of a metric. Each metric is identified by its name and labels. HTTP Server It allo...
Read more

Monitoring 101

What is Monitoring ?? Monitoring refers to a tool that collects metrics data, provides a dashboard to visualize the collected data, and generates alerts based on alerting rules.  Monitoring tool =~ Metrics + Visualization + Alerting Monitoring can be done in 2 ways: Blackbox Monitoring Whitebox Monitoring BlackBox Monitoring In this type of monitoring, Applications or Systems are monitored/observed from outside via APIs.  Whitebox Monitoring In this type of monitoring, Applications or Systems are monitored or observed from inside. Here, the system itself is under observation which exposes its internal state data and performance data of the system. This type of internal introspection is very powerful because it exposes the operating system telemetry and the health of each different internal component.  So after collecting internal state data, now we need to know,  what are different ways to expose or send these data ? There are 3 different ways to expose the data: Exp...
Read more

Computer Networking 101

Image
Hello Everyone !! I hope you are doing well. We all know the importance of the Internet world. But how does that happen? In the series on Computer Networking we will learn the following topics: What is the Client-Server model? What is Internet Protocol? How does our device connect to Wi-Fi or Hotspot? What happens when you search for www.google.com , www.facebook.com , www.amazon.com , www.linkedin.com , www.github.com , www.youtube.com ,etc?
Read more