Software supply chain

100%.

And I think part of the confusion comes from people misunderstanding what SBOMs and these big, lovely lists of packages that you've installed actually do.

And people think, well, I've got an SBOM, I can see what's installed, and therefore I'm safe from this type of attack.

But what we're really seeing over the past five years is this transition from supply chain attacks that have to be all the way promoted and productionized and deployed for you to be vulnerable versus these type of attacks where you just have to install the package, not even use it.

Exactly.

And it's actually becoming a part of the Cyber Resilience Act as well.

You've got to include your SBOMs.

And if you can include that information about provenance or attestation, you're golden.

Supply chain risks are also front and center.

with attackers increasingly targeting trusted software update mechanisms to deliver credential-stealing malware.

This trend highlights a persistent weakness in software supply chains, namely the trust placed in update channels.

When attackers compromise these mechanisms, they can distribute malicious payloads under the guise of legitimate updates, often bypassing traditional security controls, Organizations should rigorously validate updates, enforce code signing, and maintain strong endpoint monitoring.

Just as importantly, user awareness needs to be elevated so that employees are alert to unusual prompts or update requests.

It's about S- we're gonna do SBOMs.

I think, uh, uh, yeah, I think, well, I think the headline that caught people's attention, and it's a very sensational headline, your SBOM is fan fiction.

And I know Josh is already, and Alan Friedman, if you're listening, I know it's a very sensational headline.

Um, [clears throat] it came from this project called Yeet, yeet.cx. Have you guys ever heard of this?

I've not tested it, uh, yet.

Um, but it looks like you can kinda build, like, these little apps that pull from these pockets of information, um, like /proc, uh, is a goldmine, we call it, uh, at, at our day job, goldmine of information.

Um, [clears throat] and what the gist of the article is, is that you can build software, you can generate an SBOM for that software, but that software's gonna run somewhere and have runtime dependencies, and those runtime dependencies could contain vulnerabilities or supply chain attacks that is not covered necessarily [clears throat] in the SBOM.

So for example, like, if you really wanna dig into Linux, um, you can look in /proc/ the PID, process ID-

Are we talking about a digital will?

Yeah, it's actually like, well, think like we have like the SBOM for software building materials, but almost like have a digital building materials or your life's like, what are the things to have an inventory for things like services domains? Yeah.

I think it's good.

I think that's something you could use AI for now.