Adding blog post

Author: j28smith

marketing/content/blog/2025-06-08-sbom-signing-not-security.md

@@ -0,0 +1,51 @@
++++
+author = "Jason Smith"
+title = "🔏 SBOM Signing ≠ Security"
+date = "2025-06-08"
+linkedin = "https://www.linkedin.com/posts/j28smith_sbom-softwaresecurity-supplychainsecurity-activity-7341132648515346437-FqBE/"
+image = "img/thirdparty/2025-06-08-sbom-signing-checklist.jpeg"
++++
+
+🔏 SBOM Signing ≠ Security
+
+Just because an SBOM is signed doesn't mean it's safe.
+
+Signing is still important though. It gives you integrity. You know the SBOM wasn't tampered with after it was produced.
+
+But integrity ≠ trustworthiness.
+
+Here's why:
+
+🧱 Garbage In, Garbage Out
+
+If the SBOM was generated incorrectly, with missing or outdated components, signing it just seals in the errors.
+
+🎭 Signed ≠ Honest
+
+A signature only tells you who signed the SBOM. It says nothing about whether they were truthful, competent, or even authorized to sign it.
+
+📅 Is It Still Current?
+
+Software changes fast. An SBOM signed last week may already be outdated. If you can't link the SBOM to a specific build artifact or verify it's up to date, the signature alone doesn’t help.
+
+⚖️ Trust is Contextual
+
+Do you trust the signer? Are they using your keys, their own, or a third-party authority? Just because something can be verified doesn’t mean you'll trust what it says.
+
+✅ Signing is a Baseline, Not a Guarantee
+
+Think of signing as the "tamper-evident seal". Useful, but only meaningful if the package was accurate, complete, and fresh when sealed.
+
+🤔 The takeaway?
+
+Signed SBOMs are better than unsigned ones. But we need complete, current, and verifiable SBOMs, ideally linked to build systems and verified by trusted parties.
+
+💬👇 Would love to hear: 
+
+❓ How are you validating SBOM accuracy and provenance today?
+
+❓ Does signing increase your trust?
+
+❓ What else would increase your trust?
+
+hashtag#SBOM hashtag#SoftwareSecurity hashtag#SupplyChainSecurity hashtag#DigitalSignatures hashtag#SecureDevelopment hashtag#DevSecOps hashtag#ApplicationSecurity hashtag#SoftwareIntegrity hashtag#CyberSecurity