Software Supply Chains: Looking Inside an Application Essay
Software Supply Chains: Understanding What Is Inside an App Essay
One company’s application can involve the contribution of hundreds of developers. Their work comprises the application’s software supply chain, and the features are built using various components. One may ask, why is it essential to know what is inside an app? The strength of the final product is determined by the quality of its parts.
What Is a Software Bill of Materials?
According to NIST, a software bill of materials (SBOM) refers to “a formal record that describes the items in a software tool and the relationships between them.” It may contain open-source code and software components.
A software bill of materials contains a list of components and helps the owner obtain “composition intelligence” about the application. This intelligence supports having the ability to make “risk-focused” decisions.
Why Does It Matter
For instance, one company buys an educational application for a school, and later, a security vulnerability is detected in one component used in multiple applications. In this case, being able to identify if the company’s application is affected supports taking “actionable steps to remediate the issue” (NIST, p. 2). Another example can be when a problem is reported; however, the company is unsure if their application uses the affected component or not. This information can be critical when determining the appropriate response to the problem.
Inventory Is Not Enough
NIST notes that “having a prioritized inventory of software components is an important step toward improving your software supply chain security” (p. 9). However, the inventory does not indicate how to address each component. For instance, how does an organization know which component to keep, which to replace, and which to fork? It is also necessary to consider the implications of changes to ensure that the software will continue to function correctly after the changes. There is also a need to know what to do if the software component is no longer maintained.