English
Menu

What is SBOM (software bill of materials)?

A machine-readable list of the components that make up a piece of software, such as libraries, with their names, versions, suppliers and dependency relationships. Formats include SPDX and CycloneDX. When a vulnerability is announced in a component, it lets the affected products and versions be identified quickly, and it is also used for license management. Following a US executive order of May 2021, it has increasingly been required in government procurement and elsewhere.

Japanese name: SBOM(ソフトウェア部品表)

SBOM (software bill of materials) appears in 2 practice questions across 2 topics, including Cyber Attacks and Defense in Practice, Hardware Security: Advanced Topics and Trends.

Field: Cyber Attacks and Defense in Practice

What it contains

For each component it records the name, version, supplier, an identifier that pins it down uniquely, hash values, the license and dependencies on other components. Including not only the components used directly but also the components those components use (transitive dependencies) makes it possible to find vulnerable components deep in the tree.

How it is made and used

An SBOM is usually generated automatically by tools during the build; one made by hand soon goes out of date. By continuously matching the SBOM against vulnerability databases, the products affected by a newly announced vulnerability can be identified quickly. Companies that ship products use it in their PSIRT to inform customers.

Limitations

An SBOM is a list of components and does not guarantee that they are safe. A vulnerable component on the list is not necessarily used in a way that can actually be exploited in that product, so the decision is made together with information on exploitability (conveyed in formats such as VEX).

Try it: questions about SBOM (software bill of materials)

Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?

  1. ATo list the components such as libraries in a product with their versions, so that when a vulnerability in a component is announced, the affected products can be found at once
  2. BTo encrypt the source code of the software so that third parties, including users who bought the product, cannot read the contents of the program
  3. CTo calculate the procurement cost and lead time of components from a list of the semiconductors and electronic components used to build a product, and plan production
Show answer and explanation

Answer: A. To list the components such as libraries in a product with their versions, so that when a vulnerability in a component is announced, the affected products can be found at once

Today's software is built by combining many open-source libraries and third-party components, and components often depend on yet other components. An SBOM is a list of these components with their names, versions, suppliers and dependency relationships in a machine-readable format (such as SPDX or CycloneDX). When a serious vulnerability is found in a widely used component, as with the Log4j vulnerability (Log4Shell) disclosed in December 2021, an SBOM lets you quickly find which versions of which products are affected. In the US, an executive order of May 2021 set out a policy of requiring SBOMs for software supplied to the government.

FAQ

Is it related to the bill of materials (BOM) for semiconductors and electronic components?

The idea is the same: the bill of materials used in manufacturing applied to software. However, the components of an SBOM are software such as libraries, and its main purposes are vulnerability and license management. A list of hardware components is sometimes called an HBOM.

Which format should an SBOM use?

The widely used formats are SPDX (developed mainly under the Linux Foundation and also published as the international standard ISO/IEC 5962) and CycloneDX (developed mainly by OWASP), and many tools handle both. The choice follows the requirements of customers or regulations, and conversion between the formats is also possible.

SBOM (software bill of materials) in the explanations

Questions that mention SBOM (software bill of materials) (2)

  1. Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?
  2. Which correctly describes a hardware bill of materials (HBOM)?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Hardware bill of materials (HBOM) Cyber Kill Chain Digital forensics EDR (endpoint detection and response) Incident response Indicator of compromise (IoC) Intrusion detection system (IDS) Lateral movement MITRE ATT&CK Penetration testing

Back to the glossary