Cloud Native Computing Foundation Cloud Native Security Conference North America 2021, 30 Oct 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SBOM: The Rest Of the Story- Moderated by Emily Fox, Apple; Nisha Kumar, VMware; Allan Friedman CISA

Description

Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

SBOM: The Rest Of the Story- Moderated by Emily Fox, Apple; Nisha Kumar, VMware; Allan Friedman, CISA

In a world of compliance requirements, security compromises, and ridiculously long dependency chains, three unlikely travelers cross paths to clear the smoke and mirrors around SBOM: the rest of the story. Our champions of security, compliance, and open source embark on an epic quest to seek truth, actionable software content, and considerations for implementation. They cross the sea of noise in search of the signal by which all of industry can overcome the mighty blight of supply chain insecurity. They wrangle the SBOM misconceptions, they drudge forward through the swamp of Sharing Uncertainties, and confront the beast of Secure Builds. Will they succeed? Will you walk away enlightened, empowered, and ready to tackle the dragons of consumption, risk, and friendship in the face of SBOM publication?

A

S-Bomb the rest of the story introducing our three explorers. Alan friedman is a paladin, a warrior who swore an oath to protect and help everyone else protect themselves and others. He isn't actually good with weapons, but has studied many in arcane tool and art. A noted scholar before taking the paladin oath six years ago, he recently sojourned from ntia to sissa. He works with communities and trades across the realm to help build shared scalable defenses.

A

Well, not scalable, like a ball, because that would be bad while he certainly didn't discover the book of s-bomb. He has spent far too much time talking about it. Nisha kumar nisha is a barbarian, a fierce warrior that rushes in to defend open source from the dangers of clutter and toil. She is most effective with the snake staff, but is also pretty good with the gopher club.

A

Nisha belongs to the open source technology center tribe at vmware and emily fox emily is a former paladin turned rogue known for her stealth and getting software engineers to develop more securely without their knowledge. She lurks in cloud services at the fruit company providing precision in security architecture design, while also co-leading the security technical advisory guild in the cncf.

A

She repeatedly demonstrates resourcefulness, cunning and versatility, making her skills and those of nisha and alan essential to any successful s-bomb adventuring party. Our story begins in a world of compliance requirements, security, compromises and ridiculously long dependency chains. Three unlikely travelers cross paths to clear the smoke and mirrors around s-bomb the rest of the story.

A

Our champions of security, compliance and open source nisha alan and emily have arrived at a local pub to catch up.

A

They talk about the latest supply chain attacks, the residual effects of solar winds, how everyone is seeing an increase in attacks, eventually their conversation transitions to the most recent u.s executive order on cyber security and the multiple efforts cropping up across the world to implement the software bill of materials.

A

As they talk a stranger approaches, our travelers break off their conversation as the stranger stares intently weirdly. Their face appears to be worn by countless hours of excel use. The stranger whispers that which you seek.

B

Can only be found over there.

A

The stranger extends a long crooked finger to indicate a shelf in the corner, our travelers don't recall, being there the last time they visited the stranger coughs and turns back to our intrepid trio. They warn you may never use it, but when you need it, it is valuable.

A

Alan jumps up off of the stool and walks over to the shelf grabs a heavy large book closely resembling the complete rainbow series in size and holds it up. Emily looks at nisha who shrugs as the stranger fades from view.

A

So alan, what on earth do you have there.

C

Why this is s-bomb nisha and I have been chasing down the mysteries of this for quite some time now.

B

Indeed, I feel, like we spent the last year chasing and talking about this artifact, what's another session to set everyone straight on the actual spawn story.

A

Alan drops the s-bomb in the middle of the table, our companions settle in to begin planning. Their journey two strangers sit listening intently, so I recall alan- and I talking about this a long time ago, back before solarwinds consumed any sense of supply chain innocence. How do we expect folks to use it? Should we just throw it at people like a confusion, spell because, ultimately, that's what it's bound to cause? What kinds of information are in this thing.

B

I don't recommend throwing it at people, we want it to be useful, not confusing, and it really depends on the s-bomb. There are a lot more metadata that could be included beyond the minimum requirements. Some can provide information about the source code, the build environment and the actors who attest it to the process.

A

That makes sense. I mean security folks scare enough people as it is anytime, we can help others produce actionable security. Relevant information- that is easy, is a win in my book, but what about formats is one better than the other. I keep hearing that there's a lot of them out there.

D

True standards, both are likened dignity in fair software, where we lay our scene.

B

Alan no wrong book.

C

Oh sorry, I got a little confused in costume, so basically, there are two primary formats that are reasonably widely deployed today: uh cyclone dx, which comes up the oauth world. uh It's a a fancy project there and spdx, which is a linux foundation project that just got iso status. Both are great. Both have active development communities, um and the important thing here is that a standard format enables you to create a broader, tooling ecosystem.

C

So what we're interested in doing is saying: what's the metadata that we're tracking, let's have a common way of tracking it with clearly labeled fields, and so we can use the minimum sets to convey and move the data around.

A

So it sounds like if someone is already using one format over another there's no reason to change it, but what, if I'm not producing, s-bombs or and I'm not using a specific format, I don't want to upend my entire tool chain and tech stack and tech technology ecosystem. Just to be able to produce this thing that somewhere somewhere on the internet or in the world, is probably going to use, might look at, but then not know what to do with.

B

As alan said, the specific format is not important, but the metadata within it is regardless of what format you choose. It becomes useless if the metadata is not there, if you are not already producing s, bonds, look for tooling, that complements your existing tool chain. There are many open source tools created and maintained by volunteers, in the community and in industry working together to make the state of the art better. This is how open source works.

C

Yes, so the success of standards is openness uh and the vision here is that we should have a shared understanding of what we have and then building on top of that data layer as an industry. So we have a great open source community and open source tools and that's great there's some people trying to make money by building tools and hopefully they're interesting enough people say: hey yeah I'll pay for that, and that's okay too.

C

The important thing is that we have a shared vision about the value of this data layer and that we're building on top of that.

A

So it's not the portion of invincibility that I keep hearing about and it's going to solve all of our problems in cyber security and cloud native right.

C

um I don't know too many people that have actually been saying that I think that's something that people sort of as a straw. Man try to poke at, but reality it's it's just a data layer and we think it's a foundational data layer. So imagine it's something to akin to cve right, there's, nothing magical about giving a vulnerability, a data string uh or a number string that doesn't help you.

C

But once we have this shared vision where we can communicate about, say a vulnerability or about the components that we're using, then we can work together and then we can build more tools and find more use cases. On top of that,.

A

Having navigated past the misconceptions in the pub our travelers embark on their quest, so this book has a lot of information in it. That's great! What can we do with this information? How do you all see this meeting and s-bomb consumers needs? What use cases exist for the content in an s-bomb that metadata that nisha and alan have both referred to.

C

So an s-bomb is an important part of the balanced supply chain. Breakfast. It's the beans in your english, your full english. It's the chocolate sprinkles on your dutch roll, it's the muesli in your morning, routine! It's.

B

Apparently alan skipped breakfast today, but I'll go with that analogy.

B

S balm is like a key nutrient that, if you were deficient in manifests itself as symptoms that seem unrelated once you have an inventory of your deployed software, you can do things like correlate what you have deployed with what vulnerabilities exist or if you potentially have software whose license doesn't match your organization policy.

A

Excellent, so it can help organizations not only make but automate compliance and security decisions before deployment and after deploy. That's fantastic. What's important is that it won't convey vulnerabilities, but certainly provides you with a map about what you've got to match against what is vulnerable. This sounds like it really was designed for on-premise environments.

C

Actually, the impetus was for on-prem in the midst of time when software used to live in place rather than in the ether, the value was really uh that defenders needed to know was on their network, and you can't defend what you don't know about uh and in fact, a lot of the early adopters uh that care about. This are in critical infrastructure dealing with on-prem software things like medical devices in energy, industrial control system world, um but the spirit of needing to know what we're dealing with what we're trying to defend that lives.

C

On with the cloud native security warriors today,.

A

Honestly, that's a great point between on-prem and cloud native with more organizations either moving to acquiring or being born on cloud companies are constantly evaluating their current product space. I can see the s-bomb helping here.

B

Yes, companies are making acquisitions consolidating and driving digital transformation. Having an s bomb would help consolidate in key areas and reduce variety of versions of one software component, organized deployments and so much more.

C

Essentially, not having an spot was the supply chain, equivalent of forgetting your 20-sided dice in d d, or maybe not bothering to comment your code.

A

As nisha emily and alan continue on their journey, the beast of secure builds steps in front of them blocking their path. They must confront it before proceeding.

A

I've heard so many things about s-bomb. It seems everyone is assuming. It can do everything except be that portion of invincibility it that it can provide integrity over the entire supply chain, solve open source security and auto report security. Vulnerabilities for you, that's ludicrous right. So.

C

In fact s bomb doesn't do any of those things by itself, but try doing any of those priorities that we all should be working towards without an s bomb. It's painful, we've all tried to experience, doing it and trying to build our own or roll our own, and it can be very difficult and s bomb makes all of those easier and more scalable.

B

Yep, you are responsible for your supply chains, integrity and s-pump can help you establish the state of the items it knows about. This doesn't imply integrity of the software supply chain and signing an s-bomb is not a minimum requirement.

B

If an attacker were to successfully compromise the publishing infrastructure that produced the software and the s-bomb, and if all of that were signed, you'd simply just have an inventory of everything in the software, including any libraries the attackers introduced in the code base through the build. The s-bomb doesn't stop that.

A

Essentially, though, folks can generate it from source, build or post build with binary analysis generating the s-bomb from the build seems the right way to go. Based on what nisha is saying.

C

If you build it, you better s-bomb, I mean we know that compilers are the dark arts and build systems really can be as well. These days.

A

ah This is why it's so important that, in addition to source code, security folks are paying attention to what goes into their build workers, disabling ssh access and so much more. The build system can be compromised and impact. What is in your software and your s-bomb.

C

That's why, in the optimal case, a secured build process is what we need not just for our software, but for the s-bomb data to track it, especially in cloud native as our vision is that we're agile and we like to move fast and break things.

A

Having subdued the beast of secure, builds, our travelers have approached the swamp of sharing uncertainties unclear on how to move forward.

A

There are a bunch of minimums and, depending on your industry or regulatory requirements, these minimums may vary right. So.

C

At its core, an s-bomb is about identifying a component and to do that, there's some basics that we need. uh We need to have some identifiers, ideally some identifiers, that other people use. So you can map them between databases um and then there's a bunch of other use cases as well. uh So one popular way that people sort of say this is we want to use s bombs to track vulnerabilities and in fact some of the data formats can track vulnerability. Data in the s-bomb, which is very useful if you're a developer.

C

One of the risks, however, is if you start, depending on the s-bomb, to track this data and it moves across organizational boundaries. Then you're not sure if it's live, and so we have to be very, very careful about the assumptions that we make about the state of the data in the s-bomb and what we can and can't depend on to be completely up-to-date.

A

So, basically, because we've got so many vulnerabilities today and we want to make sure that the information that's available is complete, accurate and up-to-date, because we've never ever deployed any software anywhere in the world that has remained secure for its entire lifetime.

B

Yeah, we can actually take a page out of the manufacturing playbook, where the bill of materials is something that gets passed on from supplier to supplier until it finally ends up with the product that gets shipped.

B

And then there is a remediation process where defects out in the field get collected and sent back to the to the suppliers, and they use the s-bomb to find out which component has the defect so that they can fix that component and the cycle repeats.

A

So that makes a lot of sense and I'm assuming that they have really good established relationships. They all trust each other everything's good, but honestly that s-bomb is probably going to come from a complete stranger all the way on the other side of the world. Somebody you've never met. How can you trust what's in it to be accurate and what, if it's incomplete, what tools exist to produce s-bombs and isn't producing an accurate s bomb, a challenge to begin with and and don't even get me started on consuming them. That just seems like a nightmare.

C

So we've got a couple: fun challenges here: you're right, they're, all things that we need to tackle, so one is hey who's this coming from and of course uh we have natural tools for that uh signatures, uh digital signatures, but of course um those of you who play in xml and json know that rapper signatures are non-trivial.

C

Fortunately, both spdx and cyclone dx have been working on developing those and they're great projects like sig store to enable it second challenge is saying: well how do I know the data is true, and there are a couple of things you can do one. You can count on the fact that it's illegal to lie about a product two. You can always do the trust but verify uh you know when you should talk to earlier about uh source composition, analysis tools and binary analysis tools.

C

Those may not be the first best option, but they're a great way to validate some of this data, and then, lastly, we have the question about how do we make sure that we can consume this data and where we want to head is supporting automated decisions based on rules and there's a huge development opportunity here uh we're going to need smart people to think about this? This is the whole growth area of code. Is compliance and uh and policy is code.

C

What we want to do is sort of think about customizable approaches that are less complex and more straightforward, and to do that to make progress, we need to share what we have and work towards common policies and decisions that are useful to the s-bomb consumers.

B

That's right: alan making the s-bomb actionable for policy makers in an organization is an opportunity right for the taking.

A

A swamp monster emerges from an alcove of algae and growth and announces loudly. ha I already have that with my source code analysis tools, nisha rolls a 19 to detect glamour, and the swamp monster fades to reveal a small fly.

B

Aha dependency, trackers, like you see in source code analysis tools typically rely on a package manifest a package manifest will give you some of the information, but not all of the information. What actually gets installed is determined by say it with me. Now the builds.

A

So what about sharing s-bombs.

C

ah There be dragons, as we've reached the limits of our map. um We know that this is a priority and there are a lot of folks that are exploring how to do it. um One of the easiest ways that we can do it today is there are companies that are already saying: hey. I've got my live, build, I've got my live s bomb and I just post it online and that's great for a lot of organizations.

C

However, there are going to be some folks that say you know what I'm not ready to make this data public for whatever reason, and so then we're going to need to think about what access control can look like.

B

Or you could publish your s-bombs through customer portals or websites, or even shipping it, along with your product, very much like how you would be able to ship s-bombs with container images and store them both in a container registry.

C

And there are emerging technologies uh like manufacture, usage descriptor, which is a way of having a secure pointer to an s-bom or the d-bomb model, which is an access control overlay that allows you to sort of put a lot of supply chain data pretty much anywhere and then assign read and write and edit access it, so that your customers and your upstream providers can all talk about it and you can control how they're doing it.

A

Right- and that makes sense- and what's important really here- is that it's only good if it's relevant to the software. That's in use, not two versions behind, and that's why it would be great to be able to produce it as part of your build, because it can reliably match what you're shipping or making public at the time.

A

So, given that I'm a crafty, clever fox that I'm putting on my attacker hat, how do I explain that no attacker is going to leverage the s-bomb as a shopping list of places to exploit, as this seems like your really key area for doing reconnaissance work.

C

So you know it's 2021, so we didn't just talk about attackers or monsters. uh We actually do a little threat model, so you're really powerful attackers. uh They don't need this right. If they're going after your software, um you know jidra's free, they can do reverse engineering they're not going to they'll figure out what is in your system and at the other end of the spectrum.

C

You've got your automated attackers right people who are just doing spray and pray looking for a toehold, so they can start a ransomware project or something like that um and there again they don't need the roadmap um they're just doing automatic scanning, and if you have a flaw, they'll find it. What we need is to give the defenders the roadmap, so they know what it is that they should be paying attention to and worrying about.

B

That's right: the s-bomb is a tool for the defender, not the attacker. If you were to give a map of your castle to an attacker but have uh each entry well defended. The map is not going to be of any use.

A

That makes total sense and, like it's part, of a good defense and depth strategy, the s-bomb is not going to defeat that all by itself realistically, even if they had that full shopping list, they're going to have to do a whole lot more work, but what about sensitive information such as sources and methods? We can't possibly share everything. Please tell me no one's putting secrets in this stuff.

B

No, the s-bomb is not meant to store your secrets. There isn't really a formal standardized way of sharing sensitive information.

B

Spdx has this concept of profiles, and one of them is the usage profile which gets shared between suppliers of components and consumers of those components, and this is something the auto industry is championing.

B

This could probably provide a template for how other industries could share information.

A

I mean, ultimately, you want uniform adoption across the board, s-bom and supply chain. Security is way bigger than just cloud and cloud-native. Some industries, it sounds like, are moving really fast, like automotive and finance.

B

That's right as a cloud native community.

B

We want this to be adopted beyond just netflix and twitter, and for that to happen, we need to be really careful about how we build and inventory our software supply chain, and we need to consider what kind of checks and balances we need before we deploy our sas offerings a lot of people in cloud native when they think about sas. They think twitter and we really want to move on to.

B

We want this to move on to industries that are uh more serious, like uh healthcare and uh finance and uh government uh systems, things that keep grandma.

C

Are you saying that there are people involved in security that aren't on twitter? I'm pretty sure I would have read about that on twitter.

A

Our travelers have navigated the swamp of sharing uncertainties and are heading back to the pub to share their story, but how that story continues is up to you, the community and industry, to make something of s-bombs to use them.

A

The winds coming across the land blowing from executive orduria hint that this issue is not going away and will only get more important.

C

That's right, the leaders of the realm in the white castle, or at least the white house, have decreed that s-bomb will be a priority. uh Anyone who wants to sell critical software to the government will eventually have to have an s-bomb, and I have a hunch that companies aren't going to want to have two different versions, and so we're going to see most organizations realize that this is something they're going to need to have.

A

Can we succeed on this quest.

B

Our party of adventurers have some solid members and alan hey, but we need more help. How can folks get involved.

C

Well, uh one thing folks can do if they want to sort of see the big picture on s bomb is join this international community-led effort. uh That's brought together experts from a range of sectors and different types of technologies, and to do that uh very excited. It's an open effort uh and so get in touch with me through email or find me online.

B

Or you can join the amazing open source projects out there. Both svdx and cyclone dx are open initiatives and would love your help. A project that is near and dear to my heart is the term project which generates s1 swat container images.

A

So it sounds like there's a lot already out there, but there's even more for folks to get involved in tooling that can help generate s-bombs, as well as complement the overall supply chain security process such as tough spiffy and toto sift. So much more.

A

Our travelers return to their table awaiting new friends and colleagues to join them on their next quest. Will they see you there? The rest of the story is in your hands, but are you willing to commit thanks for watching s-bomb the rest of the story stay tuned for scenes from our next episode, where our explorers figure out how to do a live? Q? A see you soon.