SBOMs: What’s in your software ingredients list?

Software is everywhere. And for organizations dependent on software, understanding and managing the software supply chain is vital. Changes to your software supply chain may have ripple effects for your business. How do you manage that?

Join us for this Synopsys webinar to learn why a software Bill of Materials (SBOM) is an important tool in managing your software supply chain. We’ll cover:

• What an SBOM is and what role it plays in the supply chain
• How to efficiently manage the software supply chain
• What happens when something goes wrong with a link in the chain

President Biden’s executive order calls for agencies to buy only software products that have a software Bill of Materials (SBOM). Listen as Mike McGuire and Taylor Armerding discuss the role SBOMs will play in application security and what tools and methods organizations can leverage to create a comprehensive SBOM.

Gone are the days when you only had to worry about the code your developers are writing. Now you have to think about a complex supply chain, which includes everything from open source dependencies and APIs to containers, infrastructure-as-code, and CI/CD toolchains. Recent supply chain attacks, along with the U.S. executive order on cybersecurity, have organizations re-evaluating the security of their software supply chains.

In this webinar, our expert panelists will discuss
• Why securing your supply chain means more than having an accurate software Bill of Materials (SBOM)
• What the executive order and other initiatives mean for software producers and consumers
• What security and development teams need to do to manage new and evolving supply chain threats

Learn what you can do to enhance the security of your software supply chain. Register now.

In this episode Mike McGuire and Taylor Armerding discuss why supply chain attacks have become low-hanging fruit for cybercriminals and what organizations need to understand about their supply chain to avoid becoming the next target.

In this episode of AppSec Decoded, we provide an overview of a software bill of materials (SBOM) in the context of software supply chain security. Explore the range of organizational challenges that stem from their SBOM.

Software supply chain risk and software Bills of Materials (SBOMs) are top of mind across almost industry today. You’ve probably been bombarded with massive streams of information about what an SBOM is and what you can do to get one. What you might not have seen, though, is what an SBOM is not, and what type of information it does not provide. To truly mitigate risk across the software supply chain and maintain the trust of customers, it’s crucial that SBOMs are treated as part of a larger process, rather than a simple silver bullet artifact.

Join our Synopsys webinar to discover:
- What to expect from the SBOM process
- How to get the most out of your SBOM
- How to make an SBOM part of your software development and procurement life cycles

Did you know that open source code constitutes up to 95% of the code in your applications? This creates a web of dependencies that can pose security, quality, and compliance risks. Black Duck provides a solution by helping you generate an accurate software bill of materials (SBOM) in minutes, giving you visibility into your software supply chain. Watch the video to streamline your SBOM generation process and take control of your software supply chain.

Discover what the 2023 OSSRA report tells us about the popularity of open source and the risks it brings.

Learn about the crucial elements to managing open source risks as highlighted in the 2023 OSSRA report.

The executive order issued by the White House last year calls for more robust software supply chain protections for federal agencies. Meanwhile, companies are also taking steps toward securing their supply chains. And they are now facing many of the same struggles that government bodies have endured while attempting to adhere to the executive order. So what are the challenges? They include:
- Improving visibility into the global partners from which you’re sourcing components
- Instituting and operationalizing software bills of materials (SBOMs)
- Establishing the required scope of your supply chain security program

* determining what your testing procedures will entail

Join us as Tim Mackey, principal security strategist at Synopsys, offers inside analysis into the U.S. government’s foray into supply chain security. He will then reveal what lessons businesses can apply toward their own efforts in this space.

Once you have a grasp on how open source can both benefit and introduce risk to your organization, your next consideration should be learning to manage it. How can you build open source risk management governance into your development pipelines, and prove to your customers that you’re doing your part in protecting your software supply chain?

Join our talk as open source experts from Dell and GTC Law Group discuss:

• Determining which open source is the best fit for your company’s software
• Managing risk without slowing development and delivery
• Digitizing and automating open source risk governance
• Generating and utilizing compliant software Bills of Materials (SBOMs)

Modern application development and deployment models make for a software supply chain that’s more complicated than ever before. While managing the open source dependencies brought in by developers and package managers is a crucial consideration, you must begin looking further.

- Which dependencies are being included in containers after you’ve scanned the base image?
- What business, security and compliance risks are introduced by the web services you leverage?
- What are the license obligations of the code snippets automatically added by intelligent IDEs?

Join us as we discuss how to stay on top the newest application development technologies and the risks that come along with them.

Learn why it’s critical for organizations to focus on software supply chain risks. Hear from Anita D’Amico, vice president of cross-portfolio solutions and strategy at Synopsys, on her predictions for the software supply chain.

Pillar three of the National Cybersecurity Strategy, released in March 2023, includes a liability provision. This provision calls for vendors to be held liable for damages caused by their products if they weren’t built with reasonable security measures. It also establishes a baseline for cybersecurity measures for all companies doing business with the government, but implementation will require help from legislation.

For a variety of reasons, everyone is talking about software Bills of Materials (SBOMs). Some organizations are being required to generate and provide them, while others are asking for them from their vendors. One thing is for certain though - there is a lot of noise surrounding SBOMs, and it's not making it any easier to understand what must be done, what should be done, and what can be done.

Join Mike McGuire, security solutions manager with the Synopsys Software Integrity Group, as he cuts through the noise and simplifies the concept of the modern SBOM. Mike will address some of the market’s lingering questions, including:
- Why there is a heightened focus on SBOM
- What SBOM is and is not
- How to build and use an SBOM
- How they can help you secure your software supply chain.

There is a lot of talk about SBOMs (Software Bills of Materials) and Software Supply Chains, as well as emerging software security requirements being developed in the US and EU. At the same time many organizations continue to be caught unprepared to respond when new OSS vulnerabilities like those in Log4J are disclosed. Confused on where to focus?

You are not alone. In this session, we’ll help you navigate the path from SCA to SBOM management to Software Supply Chain Security.

Modern applications are no longer created from scratch; instead they are constructed of various components, including open source code that is often developed by individuals outside the organization. Our research reveals that open source code makes up 76% of the average application.

Although leveraging open source software provides access to external expertise, it also entails responsibilities for organizations. Ensuring the security, compliance, and quality of the code is crucial. This is where software composition analysis (SCA) plays a significant role.

Join this discussion that explores the following topics:

o What SCA is and how it functions
o Addressing risks through SCA
o Key elements of an effective SCA solution
o Building a comprehensive open source risk management program with SCA

The Log4j debacle highlighted just how difficult it is for security teams to find vulnerable software, and the recent executive order around a software bill of materials is highlighting the importance of knowing what software the organization is using. How can a software bill of materials help security teams with detection and response? In this webinar, experts discuss how organizations can use the software bill of materials as part of their enterprise security strategy. Learn how to implement a software bill of materials, identify controls and processes that need to be implemented alongside it, and understand potential challenges to be aware of. Organizations rarely have a clear picture of what software is running in their organization, but it doesn't have to be that way.

During this webinar you will:

- Unpack the potential, as well as limitations of a SBOM.
- Find out what you should look for in an SBOM, and how to ask for one.
- Get the facts about how security teams have successfully implemented SBOMs into their overall security strategy.

With the cost of cyberattacks predicted to cost $10.5 trillion by 2025, the European Commission is looking to transform the cybersecurity landscape through the Cyber Resilience Act. The goal of the CRA is to “bolster cybersecurity rules to ensure more secure hardware and software products.” But what does that mean for those of us already involved in AppSec?

Join our experts as they discuss how AppSec professionals may be impacted by CRA as it exists today. Specifically, we’ll explore:
- Which products may be subject to the CRA based on the definition of “digital elements”
- What impacts this could have on software supply chain moving forward
- How you can assess your AppSec programs to see where you stand with CRA as defined today

The CRA is currently a draft, as such opinions and insights from presenters are subject to change.