Subject: [Iot-onboarding] SBOM : Basic question on how it will be used

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 26 Mar 2020 13:55:27 -0400

I am starting this new thread on the subject as I am confused about
how an SBOM will actually be used on a network and I don't want to
divert the other thread.  Before I understand how it will get
distributed, I'd like to start with some basic questions.

Given that there is no automated mechanism to actually check if the
SBOM is consistent with the software that is bundled with the device
is it regarded as being just informational (i.e. an additional piece
of information about the device that the manufacturer ships)?  If the
SBOM is informational and specific to the software that is actually on
the device and you trust the software that is on the device, then I'd
imagine the device could publish its own SBOM.

-- 
M. Ranganathan

---

From: Eliot Lear <[email-masked]>
Date: Thu, 26 Mar 2020 19:07:22 +0100

Hi Ranga,

I think you ask a good question.  There is a broader picture of how you tie this to an entire software life cycle, that includes things like repeatable builds, remote attestation, etc.  This is just one component.  Having a good view of the whole picture is something that the NCCOE and others should definitely engage on.

> On 26 Mar 2020, at 18:55, M. Ranganathan <[email-masked]> wrote:
> 

It can do this when it has the interfaces to do it.  In some cases it won’t.  That’s why I proposed three methods.

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Fri, 27 Mar 2020 16:36:03 -0400

> imagine the device could publish its own SBOM.

I think that the SBOM is an assertion from the manufacturer that a particular
set of firmware contains a particular set of software.
The list of software (in the form of SWIDs or CoSWIDs, I hope), can be
compared automatically against CVEs.

If you want to know what firmware a device is running, then you need:
  1) an attestation that the device is trustworthy
  2) a claim from the device about it's SBOM

Generating (1) might also return the SBOM in the Attestation Result.
It might be redundant to also put it in the MUD file, but it does create a
nice auditable trail.

One vendor in this space:
https://jitsuin.com/connect/f/move-fast-and-fix-things
https://www.businesswire.com/news/home/20200213005252/en/Jitsuin-Launches-Collaborative-IoT-Security-Assurance-Platform

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-