Skip to content

Commit a8c17f5

Browse files
j28smithj28smith
authored
Merge pull request #14 from shiftleftcyber/jason
Adding / Updating Blog Posts
2 parents d8da402 + 9fbbde8 commit a8c17f5

11 files changed

Lines changed: 86 additions & 6 deletions

marketing/content/blog/2025-04-20-what_is_an_sbom_and_why_should_you_care.md renamed to marketing/content/blog/2025-03-30-what_is_an_sbom_and_why_should_you_care.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
+++
22
author = "Jason Smith"
33
title = "What is an SBOM & Why Should You Care? 🤔💡"
4-
date = "2025-04-20"
4+
date = "2025-03-30"
55
linkedin = "https://www.linkedin.com/posts/j28smith_cybersecurity-sbom-softwaresecurity-activity-7313193464173629444-8KfY"
66
image = "img/thirdparty/ingredient-list-sbom.jpeg"
77
+++

marketing/content/blog/2025-04-27-made_in_canada_in_groceries_and_in_software.md renamed to marketing/content/blog/2025-04-06-made_in_canada_in_groceries_and_in_software.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
+++
22
author = "Jason Smith"
33
title = "'Made in Canada' - in Groceries and in Software 🛒🍁💻"
4-
date = "2025-04-27"
4+
date = "2025-04-06"
55
linkedin = "https://www.linkedin.com/posts/j28smith_product-of-canada-vs-made-in-canada-activity-7315682416231096320-vusd"
66
image = "img/thirdparty/made-in-vs-product-of-canada.png"
77
youtube = "pApbYrNuAg4"

marketing/content/blog/2025-05-04-not_all_boms_are_created_equal.md renamed to marketing/content/blog/2025-04-13-not_all_boms_are_created_equal.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
+++
22
author = "Jason Smith"
33
title = "Not all BOMs are created equal 👀"
4-
date = "2025-05-04"
4+
date = "2025-04-13"
55
linkedin = "https://www.linkedin.com/posts/j28smith_sbom-cybersecurity-softwaredevelopment-activity-7318222884273823745-gKGJ"
66
image = "img/thirdparty/bom-vs-sbom.jpeg"
77
+++

marketing/content/blog/2025-05-11-whats_inside_an_sbom.md renamed to marketing/content/blog/2025-04-20-whats_inside_an_sbom.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
+++
22
author = "Jason Smith"
33
title = "What's Inside an SBOM? 🧠"
4-
date = "2025-05-11"
4+
date = "2025-04-20"
55
linkedin = "https://www.linkedin.com/posts/j28smith_sbom-cybersecurity-softwaredevelopment-activity-7320829663931510785-XfKw"
66
image = "img/thirdparty/sbom-high-level-object-model-cyclonedx.jpeg"
77
+++

marketing/content/blog/2025-05-18-sbom_creators_and_consumers copy.md renamed to marketing/content/blog/2025-04-27-sbom_creators_and_consumers copy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
+++
22
author = "Jason Smith"
33
title = "𝗪𝗵𝗼 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗯𝘂𝗶𝗹𝗱𝘀 𝗦𝗕𝗢𝗠𝘀? 𝗔𝗻𝗱 𝘄𝗵𝗼 𝗻𝗲𝗲𝗱𝘀 𝘁𝗵𝗲𝗺? 🤔🔍"
4-
date = "2025-05-18"
4+
date = "2025-04-27"
55
linkedin = "https://www.linkedin.com/posts/j28smith_sbom-supplychainsecurity-cybersecurity-activity-7323408174688980993-TPze"
66
image = "img/thirdparty/sbom-creators-and-consumers.png"
77
+++

marketing/content/blog/2025-05-25-why-sboms-are-not-one-and-done.md renamed to marketing/content/blog/2025-05-04-why-sboms-are-not-one-and-done.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
+++
22
author = "Jason Smith"
33
title = "Why SBOMs Are Not One-and-Done 📦🔄"
4-
date = "2025-05-25"
4+
date = "2025-05-04"
55
linkedin = "https://www.linkedin.com/posts/j28smith_sbom-cybersecurity-softwaresupplychain-activity-7325922851973189634-o0SG"
66
image = "img/thirdparty/2025-05-25-SBOMLifecycle.jpeg"
77
+++

‎marketing/content/blog/2025-05-11-your-sbom-can-be-hacked.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
+++
2+
author = "Jason Smith"
3+
title = "Your SBOM Can Be Hacked 📦💀"
4+
date = "2025-05-11"
5+
linkedin = "https://www.linkedin.com/posts/j28smith_sbom-cybersecurity-supplychainsecurity-activity-7328855820031406080-e8UD/"
6+
image = "img/thirdparty/2025-06-01-sbom-attack-vectors.jpeg"
7+
+++
8+
9+
Yes, even the one you just generated.
10+
11+
An SBOM (Software Bill of Materials) is supposed to bring transparency and trust to your software supply chain. But what happens when that trust is exploited?
12+
13+
Here are just a few ways bad actors can manipulate or weaponize SBOMs:
14+
15+
🔍 Omission of Components
16+
17+
An SBOM that leaves out a vulnerable dependency is worse than useless - it gives a false sense of security.
18+
19+
≠ Mismatched Versions
20+
21+
Listing libxyz v2.1.0 when you're really running v1.4.0? Easy to do - and dangerous. You might think you've patched a CVE when you actually haven't.
22+
23+
🎭 SBOM Spoofing
24+
25+
Bad actors can generate fake SBOMs and pass them off as legitimate. No validation? No problem (for them).
26+
27+
🔧 Tampering
28+
29+
Even if your SBOM was accurate when generated, nothing stops someone from modifying it later - unless it's signed.
30+
31+
If you can't verify that an SBOM is authentic, complete, and current, you're leaving the door open for manipulation.
32+
33+
🧠 SBOMs without integrity are like unsealed envelopes - anyone can open it up and alter what's inside.
34+
35+
How do you verify the integrity of your SBOMs today? Is it automated? Do you sign and verify? I'd love to hear from others navigating this. 💬👇
36+
37+
#SBOM #CyberSecurity #SupplyChainSecurity #SecureDevelopment #SoftwareIntegrity #DevSecOps #OpenSourceSecurity #ApplicationSecurity #DigitalTrust

‎marketing/content/blog/2025-05-18-what-makes-signing-sboms-hard-in-practice.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
+++
2+
author = "Jason Smith"
3+
title = "🔐 What Makes Signing SBOMs Hard in Practice?"
4+
date = "2025-05-18"
5+
linkedin = "https://www.linkedin.com/posts/j28smith_sbom-supplychainsecurity-softwaresecurity-activity-7333912094414618624-AB-Y"
6+
image = "img/thirdparty/2025-05-18-hidden-complexity-sbom-signing.jpeg"
7+
+++
8+
9+
Everyone agrees SBOMs should be signed.
10+
11+
But actually doing it? That's where things get messy.
12+
13+
Let's talk about why.
14+
15+
🔑 Key Management Is Not Fun
16+
17+
Where do the keys live? Are they stored in software or secured in hardware (HSMs)? Who manages them and who has access? How are they rotated? Is there proper auditability?
18+
19+
⚖️ Trust Models Are Inconsistent
20+
21+
Are you using your internal CA? A third-party like Sigstore? Something else? What do consumers actually trust?
22+
23+
🔄 CI/CD Integration Isn't Always Straightforward
24+
25+
You need to sign automatically as part of your pipeline, but build tools, permissions, and environments vary wildly.
26+
27+
👤 Identity Binding Matters
28+
29+
It's not just that something was signed, but who signed it? And verifying that identity isn't always easy.
30+
31+
🏢 Enterprises Want Control
32+
33+
Many larger organizations hesitate to use public, community-run signing services. They want auditability, offline modes, and policy enforcement.
34+
35+
Signing is essential for SBOM integrity but we need to make it realistically adoptable.
36+
37+
There's no one-size-fits-all approach here - and that's okay.
38+
39+
Would love to hear how others are tackling SBOM signing today. What's worked for you? What hasn't? Are we even there yet?
40+
41+
💬👇 Drop a comment or DM me. Always happy to chat.
42+
43+
#SBOM #SupplyChainSecurity #SoftwareSecurity #DigitalSignatures #PKI #DevSecOps #OpenSourceSecurity #SBOMSigning #CyberSecurity

marketing/static/img/thirdparty/2025-05-25-SBOMLifecycle.jpeg renamed to marketing/static/img/thirdparty/2025-05-04-SBOMLifecycle.jpeg

File renamed without changes.

‎marketing/static/img/thirdparty/2025-05-11-sbom-attack-vectors.jpeg‎

28.8 KB
Loading

0 commit comments

Comments
 (0)