SBOMs and their Role in Security

Alexios Zavras
Alexios Zavras
Chief Open Source Compliance Officer, Intel Corp.
Abstract

A practical deep dive into Software Bills of Materials (SBOMs): what they are, what they are not, and how they fit into modern software security. We will cover common data models and formats, how SBOMs are produced and consumed, and how they enable better visibility and faster decision-making across the software lifecycle. Interactive participation is particularly encouraged.

00:00:00 Introduction and SBOM basics

00:05:31 SBOM producers, consumers, and use cases

00:07:16 Legal, export, and security drivers

00:12:55 Regulation and minimum viable SBOMs

00:18:15 Delivering SBOM data and standardization

00:22:08 SPDX, CycloneDX, and format wars

00:26:18 Naming software components and identifiers

00:31:58 Package URLs (PURL)

00:36:10 Software Hash Identifiers (SWHID)

00:42:43 The SPDX project and graph-based data

00:53:59 RDF, triples, and serializations

01:00:06 Security content, vulnerabilities, and VEX

01:05:49 Licensing, AI, and other SBOM data

01:10:09 SBOM lifecycle types and tooling

01:17:21 Open issues and final thoughts