Security
The distinctive qualities of Software Bill of Materials
<p>Software Bill of Materials (SBOMs) have emerged as a powerful tool for
guiding supply chain security in modern software development
environments. As an 'ingredients list' of files, package dependencies
and other artefacts that a piece of software is made up of, Software
Bill of Materials are becoming an essential part of modern software
development practices.</p>
<p>Open source software provides great transparency and can yield rapid
vulnerability patching, but this is too often compromised by sprawling
dependency trees which make it difficult to find vulnerable components
in larger software projects. With SBOMs, there's a way of effectively
cataloguing software components and the package metadata needed to check
the integrity, pedigree and provenance of software supply chains. This
talk will cover the benefits of having a common standard for creating,
sharing and consuming Software Bill of Materials, what SBOMs should and
should not contain, and how to use SBOMs to inform security measures
across the diverse range of package ecosystems.</p>
In particular, this talk will cover the distinctive qualities of
effective Software Bill of Materials:
Immutability - it may be tempting to include known vulnerabilities and
other dynamic data in SBOMs, but this leads to uncertainty and
duplication of effort when that data inevitably changes. This talk will
show how to link dynamic data into SBOMs in a way that maintains the
SBOM's immutability.
Verifiability - it's hard to trust an SBOM when you can't verify that
its contents are correct. Including robust cryptographic hashes is a
critical part of creating SBOMs. This talk will show how relationships
in SBOMs can be used to associate the hashes of build artefacts with
source code, providing a way to trace back to the original projects even
when programs are statically linked!
Compatibility - no one program can check for vulnerabilities of all the
different types and across all package ecosystems, so the use of SBOMs
as a compatible format for communication between security tools is
essential for dependency analysis at scale. This talk will cover the
current state of compatibility between security tools, concluding with
practical ways that developers can integrate SBOM creation and ingestion
into their build systems.
Additional information
| Type | maintrack |
|---|
More sessions
| 2/6/22 |
<p>Currently, operating systems have become increasingly complex and thus more sensitive to security problems and performance issues. In some circumstances, developers have to reboot their systems in order to patch security vulnerabilities, fix bugs, and add new features, which will bring unavoidable downtime for running applications. Live-patch is an elegant solution. But, it can only work in 30 percent of circumstances. In our project, we put another solution into practice. We use a ...
|
| 2/6/22 |
<p>Security design is an very important step in the software development. In order to meet the principle of least privilege, developers make rules for applications based on data flow and control flow of processes, such as SELinux and AppArmor. This step can be automated with secPaver. With the permission description of application, secPaver can generate security policy for different security mechanisms. By this way, security design can be simplified, and developers do not need to know many ...
|
| 2/6/22 |
<p>Security in programming starts from the programming language itself. The majority of CVEs we encounter are due to memory safety issues and I'm here to talk about how a language like Rust is the way forward in avoiding those. Rust is a great programming language. It is a developer favorite and is rapidly gaining a foothold outside of systems programming. It has the potential to become a great general-purpose language with little of the overhead of traditional high-level general-purpose ...
|
| 2/6/22 |
<p>By design, Kubernetes will store secrets encoded in base64 within its etcd resulting in an insecure solution.<br/> While a couple commercial and open-source solutions exist to solve this problem, they all call for a separate set of tools, skills and limitations along with hardstop from CISO and Security Architect. Kubernetes put in place a KMS provider plugin framework and Trousseau leverages it to solve the secret management using standard Kubernetes API secret objects and constructs.</p>
|
| 2/6/22 |
<p>Eighteen years into my career, I decided to pivot and move from infrastructure-related work to the world of application security. If there’s one thing I’ve learned in the three years of working in application security is that it’s a funny business. Our entire business model is based on pointing out the mistakes of other programmers.</p> <p>In this talk, I want to shoot myself in the foot and share some concepts that could help eliminate a lot of those mistakes, and reduce my job to ...
|
| 2/6/22 |
<p>Tls/ssl forms the backbone of secure digital communication. This presentation covers the details about the tls protocol and its use of lower-level cryptographic methods. There is also an extensive section about the creation and use of digital certificates for authentication, with examples from web servers and Postgres.</p>
|
| 2/6/22 |
<p>Sudo is used by millions to control and log administrator access to systems, but using only the default configuration, there are plenty of blind spots. Using the latest features in sudo lets you watch some functions that previously were blind spots and you can also control access to them. There were several minor and major changes since the 1.9.0 release that I discussed in my previous FOSDEM talks. Here are the four major new features allowing you see your blind spots:</p> <ul> ...
|
