Transparency in the Software Supply Chain: Making SBOM a Reality

Overview: Dr. Allan Friedman, representing the National Telecommunications and Information Administration (NTIA) at the U.S. Department of Commerce, delivers a briefing at Black Hat on operationalizing Software Bills of Materials (SBOMs). Friedman examines the acute transparency deficit across modern software ecosystems, where embedded devices, critical infrastructure, and enterprise applications incorporate vast webs of unmanaged third-party dependencies. The talk outlines the NTIA multi-stakeholder consensus model, standardized machine-readable formats, and practical approaches for navigating vulnerability prioritization and procurement governance.

Key Topics: - Software supply chain opacity, left-pad dependencies, and widespread embedded risks - Economic market failures and the NTIA open multi-stakeholder model - Core SBOM technical framing, standardized formats (SPDX, CycloneDX, SWID), and data fields - Resolving the gap between vulnerability presence and exploitability (VEX frameworks)

Technical Details: Friedman contextualizes modern software supply chain risk by contrasting software development with traditional heavy industry. While capital equipment such as industrial diesel generators has included comprehensive bills of materials for over eight decades, network-connected software products regularly conceal deeply nested dependencies. Critical vulnerabilities, such as the Urgent/11 flaws in the ubiquitous VxWorks real-time operating system or historical vulnerabilities like Heartbleed in OpenSSL, expose how systemic blind spots prevent organizations from determining whether their environments are compromised. The software ecosystem's opacity creates distinct operational burdens across three key roles: software producers (tracking license compliance, code bloat, and shipping vulnerabilities), software buyers (evaluating procurement risk and end-of-life components), and software operators (managing rapid incident response).

Because producers lacked commercial incentives to voluntarily disclose component details and buyers historically failed to demand them, a classic market failure emerged. Operating without direct regulatory authority or enforcement budgets, the NTIA established an open, multi-stakeholder initiative convening software vendors, security researchers, healthcare networks, and international partners from the UK, Netherlands, and Japan. The initiative established four technical working groups: Framing (defining minimum required data fields including supplier name, component name, version string, unique cryptographic hash, and dependency relationships), Use Cases, Formats, and Healthcare Proof-of-Concept.

The technical working group aligned industry consensus around three established, machine-readable data formats: SPDX (Software Package Data Exchange), CycloneDX, and SWID (Software Identification) tags. A major operational challenge tackled by the framework is distinguishing raw vulnerability presence from actual exploitability. For example, while OpenSSL contains hundreds of exposed functions, only a minute subset was vulnerable to Heartbleed. This insight spurred the development of Vulnerability Exploitability eXchange (VEX) mechanisms, enabling vendors to cryptographically signal whether a flagged downstream CVE is truly reachable and exploitable within their compiled binary context.

Key Takeaways: SBOM transparency provides the essential baseline data required to automate software asset inventories, manage open-source licensing liabilities, and accelerate enterprise incident response. Organizations should mandate standardized machine-readable SBOM formats (SPDX or CycloneDX) in procurement contracts rather than accepting static documentation like PDFs. Integrating VEX advisories alongside SBOM ingestion prevents operational fatigue by allowing security teams to filter out unreachable vulnerabilities and prioritize actively exploitable components.

(AI summary — Gemini Flash)