OWASP Expands SBOM Capabilities, Accelerating Innovation and Supply Chain Risk Reduction
Jan 12, 2022
OWASP CycloneDX v1.4 Now Available
Wakefield, Massachusetts Jan 12, 2022 (Issuewire.com) - OWASP today, launched an updated version of the CycloneDX Software Bill of Materials (SBOM) standard. CycloneDX version 1.4 adds significant new cybersecurity capabilities aimed at driving innovation and increasing the operational efficiency of SBOM across the software supply chain.
With this release, CycloneDX adds the ability to communicate vulnerabilities and their exploitability for software-defined in a bill of materials. This capability, known as Vulnerability Exploitability Exchange (VEX), works with SBOMs, forming a comprehensive view of possible risk. Together, the combination of SBOM and VEX can significantly reduce the efforts and costs associated with vulnerability management.
VEX is an integral part of the CycloneDX standard, providing the convenience of leveraging a single format and toolchain. Automated analysis of CycloneDX SBOMs and VEX is further made possible by a formal Uniform Resource Name (URN) namespace, currently in review by IETF, which will provide deep-linking capabilities between SBOMs and VEX.
"VEX is the biggest contextual information gap for widespread and efficient SBOM transparency across the software supply chain," said Patrick Dwyer, co-lead of the CycloneDX Core Working Group. "Today, we are introducing new capabilities for suppliers to accurately and efficiently communicate third party component vulnerability risks in the context of their assembled software, systems, and embedded devices."
The CycloneDX standard exceeds the Minimum Elements for Software Bill of Materials as defined by the National Telecommunications and Information Administration (NTIA). Adopting CycloneDX allows organizations to quickly meet these minimum requirements and mature into using more sophisticated use cases over time.
"We've had tremendous support from the community in the development of version 1.4," says Steve Springett, co-lead and Chair of the CycloneDX Core Working Group. "The advancements made in this release provide a springboard to further adoption, innovation, and help to reduce risk in the global software supply chain".
CycloneDX is a modern bill of materials standard supporting SBOM, SaaSBOM, and a wide range of other uses. With today's launch, CycloneDX additionally adds enhanced support for hardware devices bridging gaps between traditional SBOMs and IoT, ICS, and other embedded systems.
Discover the many capabilities that CycloneDX provides at https://cyclonedx.org/capabilities/.
Media Contact
Steve Springett
7739982050
401 Edgewater Place, Suite 600
Source :OWASP
This article was originally published by IssueWire. Read the original article here.
Recommended
YOUR NEWS, OUR NETWORK.
Do you have Great News you want to tell the world?
Be it updates about your business or your community, you can make sure that it’s heard by submitting your story to our network reaching hundreds of news sites across 6 verticals.
More News
Former teacher who drowned in river was failed by mental health services
The family of a former teacher who went missing before taking her own life says her case was treated more urgently.
‘It’s an absolute mess’: Hundreds object to hotel owner’s plans for 42-bed HMO
Proposals for a hotel to be turned into new co-living apartments have been slammed amid concerns a town’s HMO numbers are “out of control”.
'It's chaotic!' Patients having to sleep in chairs due to lack of hospital beds
Patients are spending days sleeping in chairs at a “chaotic” hospital ward in scenes health campaigners have branded “totally unacceptable”.
‘My appeal has been unanswered for nearly a year’: Parking fines at industrial estate investigated
Some Blue Badge holders fined for stopping on yellow lines while collecting medication say they’re still waiting for a response to their appeals.
'We are terrified': Muslim doctor's car set alight in 'targeted' attack
A muslim family is considering leaving the country after their car was set alight outside their home in what they fear may be a hate crime.
Prince Harry reveals the 'most British thing' he, Meghan, Archie and Lilibet have been doing since their return from California - and what the children now 'approve of'
Prince Harry has revealed the 'most British thing' he, Meghan and their children have been doing since moving back to Britain from California.
Advance nails 4120g/t silver stunner in Mexico
Advance Metals has drilled a bonanza 1m hit of 4120g/t silver at its Gavilanes project in Mexico, associated with the project’s highest-grade zinc-lead mineralisation to date.
Kentucky Powerball winner arrested once again after taking home state's largest ever lotto jackpot
James Farthing, 51, was found asleep and intoxicated inside a running Mustang at a Walmart in Kentucky after deputies were called about a vehicle stopped in an intersection
Grand jury finds Nolan Wells' death was 'consistent with drowning,' no foul play suspected amid rampant theories
A Jackson County grand jury found that the evidence they reviewed did not support criminal charges be brought in connection to Nolan Wells' death over July 4th.
Eighteen-year-old charged after boy, 11, shot in face in Sydney causing critical injuries
A man has been charged after an 11-year-old boy was shot in the face inside a home in Sydney's northwest.
David Kochie's blunt letter to the RBA calling out the Albanese government - as millions of Aussies brace for another mortgage shock
Three major banks have warned mortgage holders to brace for another interest rate hike next week. Kochie has told the RBA to name those to blame.
Presley Gerber's 'inevitable' death: Family insiders reveal life-long secret struggle that sparked 'self-destruct' spiral... and mother Cindy Crawford's desperate bid to save him before shock death at 27
On Sunday, Presley Gerber, the 27-year-old son of Crawford and millionaire businessman Rande Gerber, died at a rehab facility in Los Angeles.