SBOMs: Good but less than a silver bullet

<p><a href="https://www.buzzsprout.com/twilio/text_messages/1723279/open_sms" rel="noopener noreferrer nofollow" target="_blank">Send a text</a></p><p><b>Episode Summary</b></p><p>On today’s episode, Senior Advisor and Strategist at the Cybersecurity and Infrastructure Security Agency, Allan Friedman, joins Matt to discuss SBOMs. As Senior Advisor and Strategist at CISA, Allan coordinates the global cross-sector community efforts around software bill of materials (SBOM). He was previously the Director of Cybersecurity Initiatives at NTIA, leading pioneering work on vulnerability disclosure, SBOM, and other security topics.</p><p>Before joining the Federal government, Friedman spent over a decade as a noted information security and technology policy scholar at Harvard’s Computer Science Department, the Brookings Institution, and George Washington University’s Engineering School.</p><p>He is the co-author of the popular text <em>Cybersecurity and Cyberwar: What Everyone Needs to Know</em>, has a C.S. degree from Swarthmore College, and a Ph.D. from Harvard University.</p><p>Today, Allan talks about SBOMs and their adoption in non-security industries, Secure by design and secure by default tactics, and how to make software security second nature. What, exactly, is the SBOM? Hear about how SBOMs could’ve helped against significant attacks, the concept of antifragility, and why vulnerability disclosure programs are so important.</p><p> </p><p><b>Timestamp Segments</b></p><p>·       [02:27] Allan’s career path.</p><p>·       [05:10] Allan’s day-to-day.</p><p>·       [06:15] What has been most rewarding?</p><p>·       [08:00] SBOMs in non-security startups.</p><p>·       [10:50] Real-world examples of Secure by Design tactics.</p><p>·       [17:30] Will software security ever seem obvious to us?</p><p>·       [19:30] What is the SBOM, and will it solve all our problems?</p><p>·       [23:41] Could an SBOM have helped against the SolarWinds attack?</p><p>·       [27:52] Memory-safe programming languages.</p><p>·       [30:16] Misconceptions around Secure by Design, Secure by Default.</p><p>·       [32:00] The importance of vulnerability disclosure programs.</p><p>·       [35:37] Antifragility in cybersecurity.</p><p>·       [41:47] VEX.</p><p>·       [44:29] How to get involved with CISA.</p><p>·       [48:00] How does Allan stay sharp?</p><p> </p><p><b>Notable Quotes</b></p><p>·       “Sometimes, organizations need a good excuse to do the right thing.”</p><p>·