Implement CERT-In Software Development Guidelines

Introduction

The Indian Computer Emergency Response Team, or CERT-In, is responsible for cybersecurity policy in India. As with similar organizations around the world, the value of effective Software Bill of Materials (SBOM) management has become a key to threat prevention, detection, and mitigation. In October 2024, CERT-In published its Technical Guidelines on SOFTWARE BILL OF MATERIALS to bolster the security and transparency of software supply chains. These guidelines provide a systematic framework for creating, managing, and sharing comprehensive SBOMs, enabling more effective vulnerability management and risk mitigation.

India’s approach to supporting suppliers, developers, and organizations that utilize software mirrors the trend we’re seeing around the world as governments are taking a more active role in matters of cybersecurity. While not a legal requirement, CERT-In recommends these guidelines become mandatory standard practice for entities, especially in the Government, Public Sector, Essential Services Organizations, and organizations involved with software exports and the software services industry.

In this executive summary, we examine the key features of these guidelines and how Sonatype can help address regulatory challenges and enhance software development processes for a more secure and compliant future.

CERT-In SBOM Guideline and Sonatype Capabilities

2.3 SBOM Implementation

SBOM should be implemented for every new software component release and updated promptly for any changes such as updates, upgrades, releases, and patches. The accuracy of SBOM is maintained by updating whenever there is new information about included components, regardless of whether the components themselves have changed. When modifying existing components, choose a consistent approach: either treat the change as a new component or update the existing one. For clarity, use standardized versioning methods throughout.

Sonatype SBOM Manager facilitates secure distribution and sharing of SBOM documents through a Vendor Portal, secure file-sharing, and API integrations. It can also reliably manage SBOMs at scale, which is essential for managing the large volumes of software components that make up modern applications.

3.1 Levels of SBOM

The different levels of SBOM, each offering varying degrees of granularity and complexity, indicate specific needs and the complexity of their respective software environments. Organizations should choose to implement one or more SBOM levels to achieve an efficient balance of transparency, risk management, and operational efficiency.

Sonatype supports the generation and management of various levels of SBOMs, such as Top-Level, N-Level, Delivery, Transitive, and Complete SBOMs, as well as SBOMs aligned with different stages of the Software Development Lifecycle (SDLC) like Design, Source, Build, Analyzed, Deployed, and Runtime SBOMs. It also provides detailed historical version control so users are ready to address compliance and security inquiries at any time.

3.3 Roadmap for Organizations to develop and adopt SBOM

To establish an SBOM ecosystem within an organization, the development of an SBOM program should follow a phased approach, starting from a basic foundation (START), then building upon it (PROGRESS), and ultimately reaching a mature and scalable SBOM implementation (ADVANCE). The order of activities is indicative. Organization may choose to move an activity up or down depending on their overall security requirements, project timeline, and resource availability.

START

• Identify Critical Assets and Develop a Project Plan
• Determine the SBOM format and minimum requirements
• Identify security requirements, secure storage, and tooling.
• Acquire SBOM as a part of the procurement process.

PROGRESS

• Secure Installation and Operation Guidance Development.
• Assign unique identifiers to each component.
• Mapping of supplier’s SBOM with consumer’s internal SBOM
• Preparation of SBOM
• Integrate SBOM in each phase of Secure Software Development Lifecycle
• Establish secure configuration management.

ADVANCE

• Enhance vulnerability tracking processes
• Enhance incident response process
• Analysis and review for updation of existing SBOM periodically.
• Maintain awareness of emerging software components and industry advancements.

Sonatype SBOM Manager makes it possible for organizations to quickly identify and address known vulnerabilities by continuously monitoring first and third-party SBOMs for new security vulnerabilities and malware risks.

3.4 License Management

License management is an early use case for SBOM, helping organizations with large and complex software portfolios track the licenses and terms of their diverse software components, especially for open-source software. SBOM can convey data about the licenses for each component. This data can also allow the consumer to know if the software can be used as a component of another application without creating legal risk. License information for components included in software can be checked to prevent negligence in compliance, thus reducing the risk of license violations and the workloads required for license management.

Sonatype SBOM Manager helps track open-source software licenses and share package information using the SPDX (Software Package Data Exchange) format, ensuring compliance with license requirements and exceptions. Critical license details like the license type, compatibility, and any restrictions are included, making it possible to identify potential license conflicts or compliance issues.

4.3 Automation Support

Supporting automation, such as automatic generation and machine readability, enables scaling across software ecosystems and organizational boundaries. It allows for seamless integration of SBOM data into various tools and processes, facilitating collaboration and visibility across the software supply chain.

Sonatype SBOM Manager streamlines compliance with CERT-In's minimum SBOM requirements by automating the generation and maintenance of accurate and comprehensive SBOMs. It provides deep insights into open-source and third-party components, ensuring transparency and traceability throughout the software supply chain. Integrating with development workflows enables real-time monitoring for vulnerabilities, license risks, and policy violations. This ensures organizations meet regulatory mandates while maintaining secure and resilient software systems.

5.3 Secure SBOM Distribution

To implement access control, precise terms must be defined for SBOM data integration. These terms can be established through licensing, contracts, or other existing mechanisms governing software usage and rights. Suppliers, including open-source maintainers, may prefer public SBOM data, while others might opt for confidentiality, limiting access to select users. By following these steps, organizations should implement a secure and controlled distribution of SBOM, ensuring that sensitive information is accessible only to authorized parties while maintaining transparency and trust in the software supply chain.

6. Vulnerability Tracking and Analysis

This chapter discusses vulnerability tracking and analysis using Software Bill of Materials (SBOM) Vulnerability Exchange Document (VEX) and Common Security Advisory Framework (CSAF). VEX facilitates standardized sharing of vulnerability information, while CSAF provides a structured framework for describing security advisories. These include:

1. Design a VEX Document
2. Adoption of Common Security Advisory Framework (CSAF)
3. Integration with diverse vulnerability databases and advisory
4. Implement shift-left approach and vulnerability scanning

Sonatype SBOM Manager simplifies adherence to security regulations, guidelines, and best practices on software security by ensuring that SBOMs are generated, managed, and distributed as per compliance with regulatory standards. It supports automated Vulnerability Exchange (VEX) information and data, which is crucial for regulatory compliance.

Finally, the CERT-In guidelines include a list of practical recommendations and best practices to strengthen software supply chain security.

7. Recommendations and Best Practices

Recommendations

Best Practices

Conclusion

SBOMs are one of the key building blocks of modern software development, and full transparency into what goes into the applications you build is the only way to ensure compliance.