AJR/TechradarDev
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs: streamline formatting and proofreading

Browse Source
This commit is contained in:
Stefan Rotsch
2023-10-16 12:22:46 +02:00
committed by Stefan Rotsch
parent 2c541dfbea
commit 94ac286c34
43 changed files with 177 additions and 257 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
radar/2023-09-01/sbom.md
View File

@@ -7,19 +7,18 @@ tags: [devops, security]
A Software Bill of Materials (SBOM) is an artifact that consolidates information about the dependencies of a software.
Multiple standards that define the contents and format of SBOMs exist.
The most prominent open-source formats include:
Several standards exist that define the contents and format of SBOMs. The most prominent open-source formats include:
- [CycloneDX](https://cyclonedx.org/) (OWASP): designed in 2017 with the goal to identify vulnerabilities in the software supply chain.
- [SPDX](https://spdx.dev/) (Linux Foundation): mainly focused on license compliance in the context of open source software. Support for tracking security vulnerabilities has been added in 2016 with SPDX 2.1.
- [CycloneDX](https://cyclonedx.org/) (OWASP): designed in 2017 with the goal of identifying vulnerabilities in the software supply chain.
- [SPDX](https://spdx.dev/) (Linux Foundation): primarily focused on license compliance in the context of open source software. Support for tracking security vulnerabilities was added in 2016 with SPDX 2.1.
While the goals of these SBOM formats vary, they both support
While the goals of these SBOM formats vary, they both support:
- automated generation of SBOMs from source code and
- machine-readable output to enable automated processing of SBOMs.
- Automated generation of SBOMs from source code.
- Machine-readable output to enable automated processing of SBOMs.
We see potential for SBOMs to improve software supply chain security by facilitating
We see the potential for SBOMs to enhance software supply chain security by:
- transparency regarding direct and transitive software dependencies,
- automated detection of software dependencies with known vulnerabilities and
- interoperability of security tools that support the same SBOM standards.
- Providing transparency regarding direct and transitive software dependencies.
- Automating the detection of software dependencies with known vulnerabilities.
- Promoting interoperability of security tools that support the same SBOM standards.