Does your business need a software bill of materials?

A major vulnerability in Apache Log4j created urgent pressure to determine which applications and services were affected and to apply patches before exploitation. Many modern applications rely on open source and third-party dependencies, so a large portion of software risk comes from components teams did not write. When a widely used library is compromised, the impact can spread across many regions and sectors. An SBOM can improve visibility into software supply chains by listing components, enabling faster identification of exposure and more efficient patching. SBOMs are increasingly required by regulations, including the US Executive Order on Cybersecurity, the EU Cyber Resilience Act, and the EU NIS2 directive.

"At the end of 2021, a now infamous vulnerability was found in the Apache Log4j open-source logging library. It led to a race against time, with teams struggling to identify which apps and services were affected and apply the patch before attackers could exploit the bug."

"Most modern applications include open source and third party components. As a result, a large share of software risk comes from dependencies that teams did not write themselves. When a serious issue like Log4j appears, the first question is simple: Where are we exposed? says Ilkka Turunen, field CTO at Sonatype."

"Log4j is the prime example of why SBOMs can be indispensable, says Dana Simberkoff, chief risk, privacy and information security officer at AvePoint. Because the library is very broadly used in consumer and business-facing software applications, the attack on Log4j had catastrophic consequences for a wide range of applications across regions and sectors."

"An SBOM might have prevented the worst effects of the attack by allowing IT professionals to more easily expose and patch the vulnerability that triggered it, according to Simberkoff. As the risk of similar software supply chain threats multiplies, a software bill of materials (SBOM) can help."

Read at www.itpro.com