Elektrine
Log in Register

#sbom

58 posts · Last used 15d

anchore @anchore@mstdn.business
· 2w ago
Anchore is now an OpenChain Partner in the Vendor category. OpenChain, hosted by the Linux Foundation, maintains ISO/IEC 5230 (license compliance programs) and ISO/IEC 18974 (open source security assurance). Both come back to one question: what's actually in your software? https://anchore.com/blog/anchore-is-now-an-openchain-partner/#OpenChain #OpenSource #SBOM #SupplyChainSecurity
Anchore Becomes an OpenChain Partner for ISO 5230 and 18974
anchore.com

Anchore Becomes an OpenChain Partner for ISO 5230 and 18974

Anchore is now an OpenChain Partner in the Vendor category. See how Syft and Grype support ISO/IEC 5230 and 18974 with SBOMs and vulnerability scans.

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2mo ago
Microsoft will require a Windows driver SBOM and VEX statement for signing from March 2027, aligning WHCP with the EU CRA. #Windows #SBOM #VEX #WHCP #CyberResilienceAct #DriverSecurity #SupplyChainSecurity
Microsoft to Require Windows Driver SBOM and VEX Statements from March 2027
securityonline.info

Microsoft to Require Windows Driver SBOM and VEX Statements from March 2027

Microsoft will require a Windows driver SBOM and VEX statement for signing from March 2027, aligning WHCP with the EU CRA.

0
0
0
0
constantinemakoid @constantinemakoid@infosec.exchange
· 2mo ago
Boosted by @welcome@friends.deko.cloud
#introduction I work on software supply-chain evidence, and I have one argument I would like to be wrong about. The CRA's two dates get planned in the wrong order. Reporting an exploited vulnerability within 24 hours starts 11 September 2026. The machine-readable SBOM is only required from 11 December 2027 — fifteen months after the clock starts. On a 24-hour clock the first question is not how to word the notification. It is which of your services ship the component. #CRA #SBOM
1
0
3
0
Allan Friedman @allanfriedman@infosec.exchange
· 3mo ago
The SBOM minimum just got bigger. CISA and its international partners have released a substantially expanded Minimum Elements. It adds and clarifies most of the new fields from the 2025 CISA draft, and sets a far stronger expectation for how much of the software an hashtag#SBOM should actually cover.
linkedin.com

The Minimum Just Got Bigger: CISA (and friends

When we developed the original Minimum Elements at NTIA in 2021, the goal was not to describe the perfect SBOM. It was to establish a practical floor: enough common data, in a machine-readable format, to allow an emerging ecosystem to begin generating, exchanging, and using SBOMs.

4
3
2
0
SecBurg @secburg@infosec.exchange
· 3mo ago
OWASP Dependency-Track v5.0.3 released https://secburg.com/posts/dependency-track-v503-released/ #DependencyTrack #OWASP #SBOM #SupplyChainSecurity #DevSecOps
secburg.com

OWASP Dependency-Track v5.0.3 released

OWASP Dependency-Track keeps track of what’s inside your software. Feed it an SBOM and it flags known vulnerabilities and policy violations component by component, then plugs into whatever security and dev tooling you already run.

3
0
2
0
FIRST.org @firstdotorg@infosec.exchange
· 3mo ago
🎙️ New FIRST Impressions Podcast Episode: Chris Butera (CISA) Recorded live at #FIRSTCON26 in Denver, this episode features Chris Butera, acting Executive Assistant Director for Cybersecurity at CISA, the local host of the conference. Chris joins the podcast to discuss the future of the #CVEprogram, software supply chain security, AI-specific SBOMs, end-of-support risk management, and the importance of strong collaboration between government and industry. If you’re interested in vulnerability management, AI security, supply chain resilience, or the evolving cybersecurity ecosystem, this is an episode you won’t want to miss! 🎧 Tune in to hear how CISA is helping shape the future of cyber defense and vulnerability coordination across the global community. #FIRSTCON26 #FIRSTImpressions #CISA #Cybersecurity #CVE #SBOM #AISecurity #SupplyChainSecurity #VulnerabilityManagement
media.first.org
0
0
0
0
anchore @anchore@mstdn.business
· 3mo ago
A zero-day vulnerability is inevitable. The question is whether your organization is ready. Our latest on-demand webinar highlights the contrast between manual searches and an SBOM-powered response. Stop the chaos and start executing a plan. ➡️ Ready to see the difference? Watch the on-demand webinar: https://go.anchore.com/rapid-incident-response-with-sboms/ #SBOM #IncidentResponse #Cybersecurity
go.anchore.com

Rapid Incident Response to Zero-Day Vulnerabilities with SBOMs

SBOMs are typically thought of as a developer tool to shift supply chain security left but the most popular SBOM use-case is security incident response.

0
0
0
0