Best Practices

The section Best Practices is designed to share practices that were found to be successful by our members. Our best practices determine what is most suitable for us to use and how to implement it in order to tackle specific questions that were discussed during our work sessions.

SBOM - “software bill of materials

• The Log4j vulnerability taught us that almost every software/solution company includes open source in their software. Software developers and vendors often create products by assembling existing open source and commercial software components. This incident led us to consider the use of open source in the applications we produce or the use of opensource in the solutions we get from the supplier chain.

A SBOM is a nested inventory, a list of ingredients that make up software components.  It is considered as a key building block in software security and software supply chain risk management. Therefore it was also designated as best practice to adopt when building software or buying a product. SBOM is NOT limited for open-source.

More info : Software Bill of Materials | CISA

How to implement : see ppt from expert talk (session 1)

In 2023, we will have a second workshop on this topic .