Elektrine
Log in Register

#sbom

56 posts · Last used 11d

Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 1mo ago
Microsoft will require a Windows driver SBOM and VEX statement for signing from March 2027, aligning WHCP with the EU CRA. #Windows #SBOM #VEX #WHCP #CyberResilienceAct #DriverSecurity #SupplyChainSecurity https://securityonline.info/windows-driver-sbom-vex-2027/?utm_source=mastodon&utm_medium=jetpack_social
Microsoft to Require Windows Driver SBOM and VEX Statements from March 2027
Daily CyberSecurity

Microsoft to Require Windows Driver SBOM and VEX Statements from March 2027

Microsoft will require a Windows driver SBOM and VEX statement for signing from March 2027, aligning WHCP with the EU CRA.

0
0
0
0
constantinemakoid @constantinemakoid@infosec.exchange
· 1mo ago
Boosted by @welcome@friends.deko.cloud
#introduction I work on software supply-chain evidence, and I have one argument I would like to be wrong about. The CRA's two dates get planned in the wrong order. Reporting an exploited vulnerability within 24 hours starts 11 September 2026. The machine-readable SBOM is only required from 11 December 2027 — fifteen months after the clock starts. On a 24-hour clock the first question is not how to word the notification. It is which of your services ship the component. #CRA #SBOM
0
0
1
0
Allan Friedman @allanfriedman@infosec.exchange
· 2mo ago
The SBOM minimum just got bigger. CISA and its international partners have released a substantially expanded Minimum Elements. It adds and clarifies most of the new fields from the 2025 CISA draft, and sets a far stronger expectation for how much of the software an hashtag#SBOM should actually cover. https://www.linkedin.com/pulse/minimum-just-got-bigger-cisa-friends-new-sbom-allan-friedman-phd-6jhle
linkedin.com

The Minimum Just Got Bigger: CISA (and friends

When we developed the original Minimum Elements at NTIA in 2021, the goal was not to describe the perfect SBOM. It was to establish a practical floor: enough common data, in a machine-readable format, to allow an emerging ecosystem to begin generating, exchanging, and using SBOMs.

0
1
0
0
SecBurg @secburg@infosec.exchange
· 2mo ago
OWASP Dependency-Track v5.0.3 released https://secburg.com/posts/dependency-track-v503-released/ #DependencyTrack #OWASP #SBOM #SupplyChainSecurity #DevSecOps
SecBurg - InfoSec Blog

OWASP Dependency-Track v5.0.3 released

OWASP Dependency-Track keeps track of what’s inside your software. Feed it an SBOM and it flags known vulnerabilities and policy violations component by component, then plugs into whatever security and dev tooling you already run.

3
0
2
0
FIRST.org @firstdotorg@infosec.exchange
· 2mo ago
🎙️ New FIRST Impressions Podcast Episode: Chris Butera (CISA) Recorded live at #FIRSTCON26 in Denver, this episode features Chris Butera, acting Executive Assistant Director for Cybersecurity at CISA, the local host of the conference. Chris joins the podcast to discuss the future of the #CVEprogram, software supply chain security, AI-specific SBOMs, end-of-support risk management, and the importance of strong collaboration between government and industry. If you’re interested in vulnerability management, AI security, supply chain resilience, or the evolving cybersecurity ecosystem, this is an episode you won’t want to miss! 🎧 Tune in to hear how CISA is helping shape the future of cyber defense and vulnerability coordination across the global community. #FIRSTCON26 #FIRSTImpressions #CISA #Cybersecurity #CVE #SBOM #AISecurity #SupplyChainSecurity #VulnerabilityManagement https://media.first.org/podcasts/FIRST_Impressions-butera26.mp3
media.first.org
0
0
0
0
OWASP Foundation @owasp@infosec.exchange
· 2mo ago
OWASP Dependency-Track 5.0 is now generally available. Codenamed Hyades, v5 delivers the biggest redesign in project history: stateless, horizontally scalable APIs; durable execution that resumes BOM processing and vulnerability analysis after crashes; component integrity verification against upstream registry tampering; and a CEL-based policy engine. Early adopters processed 20,000+ SBOMs/hour. PostgreSQL is now the sole supported database. https://dependencytrack.org/ #OWASP #SBOM
Dependency-Track | Software Bill of Materials (SBOM) Analysis
Dependency-Track

Dependency-Track | Software Bill of Materials (SBOM) Analysis

Dependency-Track is the open source platform that over 20,000 organizations use to inventory components, find vulnerabilities, and enforce policy across the software supply chain.

6
0
2
0