Cloud Native
Security Talks RSS

KubeCon North America 2022

SBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs

Brandon Lum, Google & Chris Phillips, Anchore

Abstract

Creating SBOMs (Software Bill of Materials) for our software artifacts is very important in understanding our software and responding to security attacks/vulnerabilities. However, creating SBOMs is challenging. To be effective, SBOMs must be as accurate and complete as possible, but at the same time be usable. Today, Software Composition Analysis (SCA) based SBOM generation tools strike a great balance in this regard. There are several great SCA-based SBOM generator tools today, but all of them have blind spots, such as finding an executable file that has no metadata associated with it. What if there was a way for SBOM tools to reliably fill in these gaps in order to produce a more complete SBOM? Enter the SBOM X-ray vision! In this talk, we demonstrate a novel way to peek into these opaque files through SBOM discovery and look-up. Through the use of the Rekor transparency log and In-toto attestations, we’ll show how easy it is for existing projects to share SBOM information with other projects using native CI integrations. We will then show our new superpowers in action through the Syft tool to generate more complete SBOMs!

More from KubeCon North America 2022

Open in the index →
  1. Using the EBPF Superpowers To Generate Kubernetes Security PoliciesMauricio Vásquez Bernal & Alban Crequy, Microsoft 2022-10-26
  2. Untrusted Execution: Attacking the Cloud Native Supply ChainAndrew Martin, ControlPlane 2022-10-26
  3. Securing the IaC Supply ChainJesse Sanford, Autodesk & Jason Hall, Chainguard 2022-10-26
  4. SLSA FRSCA Recipe For Secure Supply ChainParth Patel & Michael Lieberman, Kusari 2022-10-26
  5. Kubernetes to Cloud Attack Vectors: Demos InsideDanny Hershko Shemesh & Alon Schindel, Wiz 2022-10-26
  6. Armoring Cloud Native Workloads With LSM SuperpowersBarun Acharya, Accuknox 2022-10-26
  7. Securing Edge Workloads With Cert-Manager And SPIFFESitaram IYER & Riaz Mohamed, Jetstack Ltd 2022-10-27
  8. Run As “Root”, Not Root: User Namespaces In K8sMarga Manterola, Isovalent & Rodrigo Campos Catelin, Microsoft 2022-10-27
  9. Path To Production: Sustainable Compliance In Strict EnvironmentsChip Zoller, Nirmata & Brandt Keller, Defense Unicorns 2022-10-27
  10. Migrating From PodSecurityPolicyTim Allclair & Sam Stoelinga, Google 2022-10-27
  11. It's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!Mihai Maruseac, Google & Michael Lieberman, Independent 2022-10-27
  12. How the Argo Project Transitioned From Security Aware To Security FirstHenrik Blixt & Michael Crenshaw, Intuit 2022-10-27
  13. Hack Back; Let’s Learn Security With CTFs!Lewis Denham-Parry, Chainguard & Natalia Reka Ivanko, Isovalent 2022-10-27
  14. You Like It Or Not; You Need It! - PKI And Certificate ManagementShweta Vohra, IBM 2022-10-28
  15. What Data Tells Us About Software Supply Chain Security & What To Do About ItJosh Bressers, Anchore; Tracy Miranda, Chainguard; John Yeoh, Cloud Security Alliance; Eric Tice, Wipro 2022-10-28
  16. Tutorial: Reducing the Sticker Price Of Kubernetes SecurityPushkar Joglekar, VMware 2022-10-28
  17. The Insider Threat: Third-Party Applications In Your ClusterDagan Henderson, Raft, LLC & Will Kline, Dark Wolf Solutions 2022-10-28
  18. So, SBOMs Matter…Now What?Sophie Wigmore & Frankie Gallina-Jones, VMware 2022-10-28
  19. Putting Hackers Breaching Your Cluster In Automatic QuarantineZiv Nevo, IBM 2022-10-28
  20. Fuzzing Session: Finding Bugs and Vulnerabilities AutomaticallyDavid Korczynski & Adam Korczynski, Ada Logics 2022-10-28
  21. B’Envoy-age to Pre-Quantum EncryptionDaniel Rouhana, Independent; Emma Dickenson, Washington State University; Doron Podoleanu, F5 2022-10-28