The cost of cyberattacks on software supply chains is a growing problem, with the average data breach costing $4.45 million in 2023. Since President Biden’s 2021 executive order, software bills of materials (SBOMs) have become a cornerstone in protecting supply chains.

In December 2023, the National Security Agency (NSA) published new guidance to help organizations incorporate SBOMs and combat the threat of supply chain attacks.

Let’s look at how things have developed since Biden’s 2021 order and what these updates mean for the owners and operators of national security systems.

Navigating new standards: NIST and CISA’s contributions

Since 2021, the National Institute of Standards and Technology (NIST) and Cybersecurity and Infrastructure Security Agency (CISA) have been pivotal in shaping SBOM standards. Their guidelines aim to offer companies and operators a complete picture of software components, including open-source software.

An SBOM should provide transparency into the ingredients of software, including:

• Open-source libraries and dependencies
• Commercial/proprietary libraries and modules
• Services and tools
• Versions of libraries and components
• Relationships between components
• Licensing information.

It’s important to collect and share this information in a clear format. There are three commonly-used standards for SBOMs:

• Software Package Data Exchange (SPDX®): An open-source, machine-readable format developed by the Linux Foundation. SPDX is a flexible option with the size and capacity to be an all-inclusive format.
• CycloneDX (CDX): An open-source, machine-readable format from the OWASP community. CDX is a more agile, user-friendly option than SPDX.
• Software Identification (SWID): An ISO/IEC industry standard that many commercial software publishers use. This is, by far, the easiest standard to use — but its capabilities are limited to simple inventory and cataloging.

This standardization makes it easier for operators to understand and manage the security risks related to the software. Unfortunately, operators managing intricate tech stacks and cybersecurity systems often need to use more than one standard, which poses additional challenges.

What are the problems with SBOMs?

SBOMs offer information about code provenance and help software engineering teams detect malicious attacks in their early stages — often during development and deployment. However, getting in line with the U.S. government’s regulations around SBOMs is not straightforward.

Here are some concerns:

• Complex requirements: An app may comprise files, functions or code from separate third-party sources. Without proper documentation during development, creating an accurate SBOM that includes all components is challenging.
• Lack of data: SBOMs explain the ingredients in software but share nothing about the quality of those components, the contributors or the processes around quality control.
• Time investment: Companies must dedicate a lot of time to properly research and document SBOMs. Also, SBOMs are not static documents, so a new SBOM will be needed with every release or update — making this an ongoing draw on company resources.
• Budget: With more time spent on SBOMs, compliance costs will impact the company’s payroll. Also, there’s a chance that SBOM focus can distract software developers from focusing on more serious security risks.
• Intellectual property concerns: Sharing detailed software components can feel like giving away trade secrets. It’s a tightrope walk between optimal security and competitive positioning.

An imperfect step in the right direction

With the NSA’s latest updates for SBOM management, we can expect SBOMs to become a key aspect of securing and managing software supply chains in 2024. companies can use them to offer software developers and customers transparency about the software they use.

But it’s important to remember that SBOMs are not a magic bullet against cyberattacks on supply chains. Challenges in cost and compliance remain a concern, especially for smaller organizations.

Operators in national security and enterprises must adapt to the changes and collaborate with software developers to give companies the best chance of protecting their supply chains and assets.

Ready to take action? Learn how to secure your supply chain through cyber risk management.