https://urgentcomm.com/wp-content/themes/ucm_child/assets/images/logo/footer-new-logo.png
  • Home
  • News
  • Multimedia
    • Back
    • Multimedia
    • Video
    • Podcasts
    • Galleries
    • IWCE’s Video Showcase
    • IWCE 2022 Winter Showcase
    • IWCE 2023 Pre-event Guide
  • Commentary
    • Back
    • Commentary
    • Urgent Matters
    • View From The Top
    • All Things IWCE
    • Legal Matters
  • Resources
    • Back
    • Resources
    • Webinars
    • White Papers
    • Reprints & Reuse
  • IWCE
    • Back
    • IWCE
    • Conference
    • Special Events
    • Exhibitor Listings
    • Premier Partners
    • Floor Plan
    • Exhibiting Information
    • Register for IWCE
  • About Us
    • Back
    • About Us
    • Contact Us
    • Advertise
    • Terms of Service
    • Privacy Statement
    • Cookie Policy
  • Related Sites
    • Back
    • American City & County
    • IWCE
    • Light Reading
    • IOT World Today
    • Mission Critical Technologies
    • TU-Auto
  • In the field
    • Back
    • In the field
    • Broadband Push-to-X
    • Internet of Things
    • Project 25
    • Public-Safety Broadband/FirstNet
    • Virtual/Augmented Reality
    • Land Mobile Radio
    • Long Term Evolution (LTE)
    • Applications
    • Drones/Robots
    • IoT/Smart X
    • Software
    • Subscriber Devices
    • Video
  • Call Center/Command
    • Back
    • Call Center/Command
    • Artificial Intelligence
    • NG911
    • Alerting Systems
    • Analytics
    • Dispatch/Call-taking
    • Incident Command/Situational Awareness
    • Tracking, Monitoring & Control
  • Network Tech
    • Back
    • Network Tech
    • Interoperability
    • LMR 100
    • LMR 200
    • Backhaul
    • Deployables
    • Power
    • Tower & Site
    • Wireless Networks
    • Coverage/Interference
    • Security
    • System Design
    • System Installation
    • System Operation
    • Test & Measurement
  • Operations
    • Back
    • Operations
    • Critical Infrastructure
    • Enterprise
    • Federal Government/Military
    • Public Safety
    • State & Local Government
    • Training
  • Regulations
    • Back
    • Regulations
    • Narrowbanding
    • T-Band
    • Rebanding
    • TV White Spaces
    • None
    • Funding
    • Policy
    • Regional Coordination
    • Standards
  • Organizations
    • Back
    • Organizations
    • AASHTO
    • APCO
    • DHS
    • DMR Association
    • ETA
    • EWA
    • FCC
    • IWCE
    • NASEMSO
    • NATE
    • NXDN Forum
    • NENA
    • NIST/PSCR
    • NPSTC
    • NTIA/FirstNet
    • P25 TIG
    • TETRA + CCA
    • UTC
Urgent Communications
  • NEWSLETTER
  • Home
  • News
  • Multimedia
    • Back
    • Video
    • Podcasts
    • Omdia Crit Comms Circle Podcast
    • Galleries
    • IWCE’s Video Showcase
    • IWCE 2023 Pre-event Guide
    • IWCE 2022 Winter Showcase
  • Commentary
    • Back
    • All Things IWCE
    • Urgent Matters
    • View From The Top
    • Legal Matters
  • Resources
    • Back
    • Webinars
    • White Papers
    • Reprints & Reuse
    • UC eZines
    • Sponsored content
  • IWCE
    • Back
    • Conference
    • Why Attend
    • Exhibitor Listing
    • Floor Plan
    • Exhibiting Information
    • Join the Event Mailing List
  • About Us
    • Back
    • About Us
    • Contact Us
    • Advertise
    • Cookie Policy
    • Terms of Service
    • Privacy Statement
  • Related Sites
    • Back
    • American City & County
    • IWCE
    • Light Reading
    • IOT World Today
    • TU-Auto
  • newsletter
  • In the field
    • Back
    • Internet of Things
    • Broadband Push-to-X
    • Project 25
    • Public-Safety Broadband/FirstNet
    • Virtual/Augmented Reality
    • Land Mobile Radio
    • Long Term Evolution (LTE)
    • Applications
    • Drones/Robots
    • IoT/Smart X
    • Software
    • Subscriber Devices
    • Video
  • Call Center/Command
    • Back
    • Artificial Intelligence
    • NG911
    • Alerting Systems
    • Analytics
    • Dispatch/Call-taking
    • Incident Command/Situational Awareness
    • Tracking, Monitoring & Control
  • Network Tech
    • Back
    • Cybersecurity
    • Interoperability
    • LMR 100
    • LMR 200
    • Backhaul
    • Deployables
    • Power
    • Tower & Site
    • Wireless Networks
    • Coverage/Interference
    • Security
    • System Design
    • System Installation
    • System Operation
    • Test & Measurement
  • Operations
    • Back
    • Critical Infrastructure
    • Enterprise
    • Federal Government/Military
    • Public Safety
    • State & Local Government
    • Training
  • Regulations
    • Back
    • Narrowbanding
    • T-Band
    • Rebanding
    • TV White Spaces
    • None
    • Funding
    • Policy
    • Regional Coordination
    • Standards
  • Organizations
    • Back
    • AASHTO
    • APCO
    • DHS
    • DMR Association
    • ETA
    • EWA
    • FCC
    • IWCE
    • NASEMSO
    • NATE
    • NXDN Forum
    • NENA
    • NIST/PSCR
    • NPSTC
    • NTIA/FirstNet
    • P25 TIG
    • TETRA + CCA
    • UTC
acc.com

Software


Partner content

This will be the year of the SBOM, for better or for worse

This will be the year of the SBOM, for better or for worse

  • Written by Peter Morgan / Dark Reading
  • 24th February 2023

Companies are facing two major truths this year: More cybersecurity regulation and fewer resources.

For the former, it’s about time. Cybersecurity needs baseline requirements and government regulations can be a useful forcing function. It’s encouraging to see a renewed focus on areas that need real attention, especially software supply chain security. Considering the latter, it means companies are facing a steep climb ahead to implement these new regulations in a year of economic uncertainty. Nonetheless, regulations are here, more regulations are coming, and companies need to adapt.

In a recent article, I discussed a few issues with the software bill of materials (SBOM) format as a standard, which includes:

  • Requirements vs. optional fields
  • Complete lack of provenance consideration

But this year, the biggest hurdle will be adoption.

The Software Vendor Adoption Problem

ACMECorp is an example of a company that produces software products. We’ll refer to one of its products as “Anvil” and its customers as “Clients.”

Clients want ACMECorp to release its SBOMs for Anvil so Clients can understand if they’re affected by software supply chain issues, vulnerabilities, or license risks. Clients also want to be able to understand quickly if they’re affected as new issues arise.

Regulatory bodies want to require ACMECorp to release SBOMs so Clients can be better informed. ACMECorp may very well want to provide this information to Clients as well, but this is a massive undertaking.

For all software products, ACMECorp will now need to:

  1. Identify all software components used as dependencies. This is at minimum dozens and at most tens of thousands of individual software components.
  2. Identify all the potential security issues. This includes a security audit of a product and all of its dependencies.
  3. Investigate each potential security issue and determine ACMECorp’s response, which will range somewhere between “we have to fix this now” and “not applicable.” The resulting analysis from the software security team charged with performing this work will inevitably meander through teams of lawyers to determine exposure and risk. This is crucial, because ACMECorp will need this information to:
  4. Stand up a new department to handle the barrage of inevitable questions and challenges from Clients to the responses developed.
  5. Release SBOMs to Clients with as little detail as possible to protect intellectual property and limit exposure.
  6. Do the entire process again for every version that is released, in perpetuity, and keep historical records.

It’s a heavy lift, but ACMECorp will need to have a version of the above (or at least a start to it) that it expects Clients to accept.

To read the complete article, visit Dark Reading.

 

Tags: Applications Critical Infrastructure Cybersecurity Enterprise Federal Government/Military Incident Command/Situational Awareness Interoperability News Policy Public Safety Security Software State & Local Government System Design System Installation System Operation Tracking, Monitoring & Control Training Partner content

Most Recent


  • Verizon officials highlight role of 5G tech for responders during IWCE keynote
    LAS VEGAS—As the public-safety sector continues to expand its use of data-intensive applications, developments in 5G can provide the low-latency, high-bandwidth connectivity to meet these needs, Verizon officials said yesterday during a keynote address at IWCE 2023. Bryan Schromsky, managing partner for Verizon’s public-sector unit, noted that the carrier plans to complete its deployment of […]
  • Day 3 of IWCE 2023 features the opening of the Expo Hall
    A small crowd gathered around a four-legged robot that shifted with lifelike movements, running forward onto the show floor of the 2023 IWCE exposition in Las Vegas, Nev. “It’s meant for public safety and inspection of infrastructure,” said Charlie Robb, chief revenue officer for Common Objects, which had outfitted the Boston Dynamics robot, Spot, with […]
  • Rescue 42 launches miniCRD deployable for FirstNet
    Rescue 42 yesterday announced the launch of its miniCRD (mCRD) for FirstNet, which provides much of the functionality of the company’s Compact Rapid Deployable at a much lower cost.and in an even more portable form factor—two ruggedized cases that are about the size of checked luggage. Rescue 42 CEO Tim O’Connell said the mCRD (pictured […]
  • IWCE 2023
    Safer Buildings Coalition conducts annual event at IWCE 2023
    A common theme ran through the Safer Buildings Coalition’s annual meeting Monday night during IWCE 2023 at the Las Vegas Convention Center—strength through collaboration. “The perception is that the challenge is ‘out there,’ and someday, maybe the challenge will come here,” said Billy Bob Brown Jr., executive assistant director for emergency communications within the Cybersecurity […]

Leave a comment Cancel reply

To leave a comment login with your Urgent Comms account:

Log in with your Urgent Comms account

Or alternatively provide your name, email address below:

Your email address will not be published. Required fields are marked *

Related Content

  • 'New class of bugs' in Apple devices opens the door to complete takeover
  • Motional robotaxis to offer night rides in Vegas
  • Spotting the losers in satellite D2D
  • NG911 needed to secure our communities and nation

Commentary


Updated: How ‘sidelink’ peer-to-peer communications can enhance public-safety operations

  • 1
27th February 2023

NG911 needed to secure our communities and nation

24th February 2023

How 5G is making cities safer, smarter, and more efficient

26th January 2023
view all

Events


UC Ezines


IWCE 2019 Wrap Up

13th May 2019
view all

Twitter


UrgentComm

Gallery: The last day of IWCE 2023 dlvr.it/SllQKJ

30th March 2023
UrgentComm

Video: Opening of the Expo Hall on day three of IWCE 2023 dlvr.it/SlkyNy

30th March 2023
UrgentComm

Verizon officials highlight role of 5G tech for responders during IWCE keynote dlvr.it/Slkh9n

30th March 2023
UrgentComm

Day three of IWCE 2023 features the opening of the Expo Hall dlvr.it/Slhgvr

30th March 2023
UrgentComm

Gallery: The Expo Hall opens on day three of IWCE 2023 dlvr.it/SlhfPT

29th March 2023
UrgentComm

Rescue 42 launches miniCRD deployable for FirstNet dlvr.it/SlgdtY

29th March 2023
UrgentComm

RT @IWCEexpo: 📽️ More sights from Day 2 at #IWCE23. It's been a fantastic start so far... Thanks to you! Tomorrow is another awesome spea…

29th March 2023
UrgentComm

RT @IWCEexpo: Ildefonso De La Cruz Morales, Principal Analyst-Critical Communications @OmdiaHQ takes the stage and kicks off tonight’s Keyn…

29th March 2023

Newsletter

Sign up for UrgentComm’s newsletters to receive regular news and information updates about Communications and Technology.

Expert Commentary

Learn from experts about the latest technology in automation, machine-learning, big data and cybersecurity.

Business Media

Find the latest videos and media from the market leaders.

Media Kit and Advertising

Want to reach our digital and print audiences? Learn more here.

DISCOVER MORE FROM INFORMA TECH

  • American City & County
  • IWCE
  • Light Reading
  • IOT World Today
  • Mission Critical Technologies
  • TU-Auto

WORKING WITH US

  • About Us
  • Contact Us
  • Events
  • Careers

FOLLOW Urgent Comms ON SOCIAL

  • Privacy
  • CCPA: “Do Not Sell My Data”
  • Cookie Policy
  • Terms
Copyright © 2023 Informa PLC. Informa PLC is registered in England and Wales with company number 8860726 whose registered and Head office is 5 Howick Place, London, SW1P 1WG.