Securing Open Source With SBOM - From Visibility To Trust

Learn how to secure open source software through Software Bill of Materials (SBOM) implementation in this conference talk that addresses the technical challenges of applying SBOMs to open source projects. Explore the complexities of identifying modified OSS components, analyzing third-party dependencies, and verifying security vulnerabilities within software inventories. Discover IoTcube.net, an automated platform that generates SBOMs and verifies vulnerabilities by integrating with OpenSSF Guac and OpenVEX to improve document usability and interoperability. Examine collaborative initiatives designed to strengthen open source software security, including standardized representation of OSS and licenses, vulnerability management for unpatched components, and SBOM management recommendations. Gain insights into potential joint efforts that can enhance the overall security posture of open source ecosystems while moving from basic visibility to establishing trust in software supply chains.