OpenSSF, CISA, and DHS collaborate on new open-source venture for creating SBOMs

Quite a lot of security-focused teams have introduced they’re teaming up on a brand new open-source venture to assist safe software program provide chains: Protobom.

The venture was created collectively by the Open Supply Safety Basis (OpenSSF), Cybersecurity and Infrastructure Safety Company (CISA), and the Division of Homeland Safety Science and Know-how Directorate (DHS S&T). 

Protobom permits firms to learn software program invoice of supplies (SBOM) knowledge, create their very own SBOMs, and translate SBOMs into totally different customary codecs. 

In accordance with OpenSSF, there are a lot of SBOM codecs and schemas on the market, which could be difficult for firms. The aim of the brand new venture is to offer a “format-neutral knowledge layer on prime of the requirements that lets functions work seamlessly with any type of SBOM.”

OpenSSF additionally defined that by integrating Protobom into functions that hyperlink SBOM and vulnerability info, organizations will be capable to extra shortly entry the required patches and mitigations to maintain their software program provide chains protected. 

“Vulnerabilities in software program are a key danger in cybersecurity, with identified exploits being a main path for unhealthy actors to inflict a spread of harms. By leveraging SBOMs as key components of software program safety, we are able to mitigate the danger to the software program provide chain and reply to new dangers sooner, and extra effectively,” stated Allan Friedman, senior advisor and strategist at CISA. “Protobom is a step in the direction of higher effectivity and interoperability by translating throughout the extensively used codecs in order that instruments and organizations can give attention to what’s essential. It’s a constructive resolution that helps form a extra clear software-driven world.”

Omkhar Arasaratnam, normal supervisor of OpenSSF, added: “Protobom not solely simplifies SBOM creation, but in addition empowers organizations to proactively handle the danger of their open supply dependencies. The safety of open supply software program requires partnership between the general public sector, personal sector and the group. The OpenSSF is proud to be part of this mission.”