Auditing SBOMs: Enhancing Software Security and Compliance

How to Audit SBOMs for Enhanced Software Security

August 14, 2024
By Aaron Linskens
4 minute read time

Software bill of materials (SBOMs) are essential elements for managing software security and compliance, especially in light of increasing open source risks.

An SBOM provides a detailed inventory of all software components within an application.

This transparency is vital not only for understanding the composition of software, but also for maintaining security and compliance in an era where software supply chains are increasingly targeted by threat actors.

The Critical Role of SBOMs in Software Security

Dr. Stephen Magill, Director of Product Innovation at Sonatype, is one of our experts on SBOMs, particularly in how to integrate them into the software development life cycle.

Why Audit SBOMs?

Dr. Magill gives several reasons why auditing SBOMs is a critical task:

Accuracy and completeness: Validate that the SBOM accurately reflects all software components, which provides transparency to help identify vulnerabilities, manage licenses, and ensure compliance with security standards.
Security and compliance: Identify risks associated with third-party components.
Vendor management: Assess third-party suppliers' security practices to mitigate software supply chain risks.

Sonatype SBOM Manager Enhances Audit Capabilities

As organizations increasingly rely upon open source software, the ability to audit and manage these elements becomes more complex.

Sonatype SBOM Manager simplifies the process of auditing SBOMs by enabling you to validate, monitor, and manage software components.

Dr. Magill highlights how SBOM Manager validates the completeness and accuracy of SBOMs via the following key features:

Vulnerability checks: SBOM Manager identifies false positives and false negatives in vulnerability reporting. It uses sophisticated matching algorithms to compare reported vulnerabilities against comprehensive, authoritative databases maintained by Sonatype.
Component verification: It ensures all components listed in the SBOM are accurate and complete. This verification is crucial in maintaining the integrity of the software and protecting it against potential security threats.
Integration with software development and security workflows: SBOM Manager fits seamlessly into existing software development and security workflows, enhancing the overall software security posture without disrupting existing operations.

Implementing SBOM Audits With Sonatype SBOM Manager

In our recent SBOM Manager Spotlight webinar, Dr. Magill discussed the importance of integrating SBOM audits into the software development life cycle, particularly focusing on third-party SBOMs.

He emphasized the relevance of the National Institute of Standards and Technology (NIST) and its Secure Software Development Framework (SSDF) as a risk management framework for integrating security best practices into development processes.

As an important takeaway from the webinar, Dr. Magill said to consider these practical steps in auditing with SBOM Manager:

Request SBOMs from vendors: As the risks associated with software supply chains increase, obtaining comprehensive SBOMs from all vendors becomes essential. These should be requested as part of the procurement process and ideally included in contractual agreements.
Import and analyze SBOMs: Once obtained, SBOMs can be imported into SBOM Manager, which then provides insights into the security of the applications and continuously monitors them for risks over time. This includes examining Vulnerability Exploitability Exchange (VEX) explanations and checking these against application and machine configurations to confirm the applicability of non-exploitability reasoning provided by vendors.

By leveraging SBOM Manager, organizations can proactively identify and mitigate open source risks, streamline auditing processes, and facilitate secure software development.

Written by Aaron Linskens
Aaron is a technical writer at Sonatype. He works at a crossroads of technical writing, developer advocacy, and information design. He aims to get developers and non-technical collaborators to work better together in solving problems and building software.