We have Anthony with the day in the life of his mom.
I will not be getting long his reductions. We don't have time for that.
Anthony, you're probably right.
Thank you. Good morning, everyone.
I have a lot to try and say in 20 minutes, so apologies if it gets quick.
So, who are I? I'm a solution architect.
I have delivered big systems that never finish, so it takes a long time to build complex systems.
I now have on my own business which is really focused on software supply chain,
S-bombs and software risk.
I'm a co-founder with only your handson of S-bombs.
You're trying to help. You're at understand what S-bombs is all about.
I like lots of open-source software.
So those of you who are the fringe event probably saw some of my software.
We've gone to mention some of it in this presentation.
And I mentor the next generation of coders.
So I'm a mentor for things like Google, Summer of Code,
Teach Python to students, et cetera.
That picture is a picture of a manchester B.
Not a no-woss wasp.
Manchester is worker.
It's the worker B. We work hard in Manchester in UK.
And when I'm not doing open-source software,
I tend to be rolling around money fields on a Saturday morning.
So I haven't done that this weekend because I've been here.
This I think is an increasingly common question.
Can you give me an S-bombs?
What's your reaction?
Is it?
Thank you.
I know why I've been creating S-bombs because people want them.
Or is it what's an S-bombs?
Or I need more information because I have got so many S-bombs which one do you want?
Because it's a problem.
S-bombs are part of risk management and S-bombs are part of use cases.
Are you using for what with your S-bombs?
Which S-bombs are what data do you need?
There's also two standards S-b-d-d-x and S-b-d-x.
Depending on what version is going to depend what information you're going to get.
And there's also these things called different types of S-bombs,
which is what we're going to describe today.
These are the typical use cases,
and there are more and more use cases coming if people realize the value of S-bombs.
So you've got license compliance, you've got vulnerability management.
We've got regulations.
I've got people looking at S-bombs to help escrow systems.
But really, I do not believe every S-bom is suitable for all those use cases.
And I believe one S-bom is not going to be good enough.
We're going to have to have several S-bombs for our products.
So we live a question shopping now.
Can you give me the white S-bom for your products?
Not just any S-bombs.
Two and a half years ago, three years ago,
S-ser published these S-bombs types.
Six S-bombs types to represent the life cycle.
Let's go in from design into an operational system.
These are now embedded within the two standards.
S-b-d-x-3, cyclone-d-x started from 1.5,
quickly cyclone-d-x adopted these standards.
You'll notice the names are slightly different, but they're map pretty well.
And the 2024 S-E-I ran a plug vest,
which was to look at the different S-bom types, S-bom tools,
across S-b-d-x and cyclone-d-x,
and they targeted source and bills.
Very few tools.
Actually mentioned the type of S-bom they were generating.
There was only one S-b-d-x version free.
A candidate and they did mention it.
But cyclone-d-x, nearly all of them with 1.5 or 1.6,
only one vendor included the S-bom type.
So why is that?
If we now start thinking about C-R-A,
which really, we know exploitable vulnerabilities,
and I know we're going to hear lots of this today,
which S-bom type do we need.
If we look at a typical S-bom typical software product,
there's lots of software operating systems,
one time systems, applications, APIs, whatever.
There's a lot of software there,
so where do we get that full complete picture
for us to then be able to then assess our system for vulnerabilities?
So let's go through each type of S-bom.
Very quickly, sorry, because I've got a lot of text.
Design S-bom's, I won't be really afraid.
This is what we're going to build.
It's not what we've built.
So it's a plan.
I couldn't find any S-bom tools that actually do design S-bom's,
so I do what normally do, I created a tool.
So I created S-bom as a code.
I don't know whether it's any use,
but I can generate something that says it's a design S-bom.
Simple YAML generates an S-bom,
but it says nothing about the target environment.
It doesn't tell you what the versions of the components are,
so I don't think a design S-bom is relevant for C-R-A.
S-S-bom's is about your source files.
You're going to identify things like licenses,
some of them.
You're going to hide it copyright.
Again, that's useful.
And direct dependencies.
But it's not going to tell you anything about what you're building again.
So you're going to get quite a richer S-bom
than you will for design,
but again, it's not going to have all the information.
Let's go to build.
We start into build components,
and we start into getting some more dependencies
like the transitive dependencies,
and we're starting to identify versions,
and we can maybe start identifying components using
some of that per or C-P-E's,
and we're going to start looking at the ecosystem.
So we're starting to get a bit more granular,
and a bit closer to the target,
but it's still not telling me what operating system we're using.
I'll just build it for Python, for example.
And again, we get more data,
but is that sufficient for doing all the vulnerabilities?
Probably not.
We then have this one called analysis.
And the idea I believe is to analyze a group of S-bom's together.
Now, that sounds really useful.
Do we need a different type of S-bom?
I don't think so.
There's lots of tools over there that analyze the quality of an S-bom,
have we included all the licenses, all the components got,
identifies et cetera,
but do we need to have a S-bom for that?
I don't think we do.
I think there's already enough tools for that,
so I don't think that type actually has a value.
Now, when we get to deploy this Bom's,
now we're starting to really get closer to the target.
What software is actually sitting on your device?
That's going to give you a precise definition of all the components.
It's starting to identify the one-time dependencies,
but don't appear until you've actually get deployed.
Every component should identify as,
it should have licenses.
We know that, no, the real honestly, don't we?
But the big benefit of here is this is the actual target environment
that actually is what you deliver to your customer.
This is the version that I believe is what we should be using
for monitoring exploits that this is what the C-R-A is going to require.
I'm sure we're going to have an interesting discussion
throughout the day about that, but that's where I'm setting my set in the C.
And then we get to runtime.
This is observing your system running.
Systems generally have multiple ways of operating,
you know, you may have a test mode, you may have an operational mode,
you have a degraded mode.
So I don't know how this is going to give you a moment of instance
in terms of what your system is executing,
but is it how useful that be in terms of identifying what's exploitable?
Again, I couldn't find tools that do runtime,
so I've started developing something that I hopefully might be useful for the community.
I've already identified ways of getting the libraries that have been loaded,
so you can look at your deploy desk bar,
and then you can see which of those libraries have actually been loaded and executed.
I'm starting to look at now at which ones are starting to call out to external services
like network services, so you can start seeing those APIs,
which might be really important for C.R.A,
which is when it says, do you need an external service to provide it to support your product?
And we can start seeing configuration files.
So this is very much working progress, like people to help me,
but actually I think this might be useful as well as as useful diagnostic tool.
So if you summarize sort of the use cases,
I think until you get to deploy,
you don't get that big full picture of how your product is,
that your product is actually being used by your customers.
There are other use cases which may be where these other types of S-bombs may be relevant.
Esco, I think, is going to be really useful at the source level.
But I think we nearly need to be looking at getting good high quality deployed S-bombs for our products.
I've been writing tools.
And so I have a library, which is the basis of all my tools.
That sort of suits like a data model, which is an abstracts,
the S-bombs that can convert between S-P-D-X and Cyclone-D-X.
One of the features I've now done is it provides the S-bombs type for S-P-D-X2,
following what OpenShame to Find, as a way of including the S-bombs type as a comment.
So we can now provide S-P-D.
Please join me in making those better.
Please make sure and help them deliver what we need.
I can't do these all myself.
They're all accessible and they're all in swap between S-B-D-X and Cyclone-D-X.
S-B-D-X-B is coming when I get round to do in it.
So to summarize, I still think there's a lot of confusion
when people say can you give me an S-Bomb.
We need to be a lot more precise about what use case that S-Bombs
is going to be used to support, and we need to recognize that most of the really useful information
that we need doesn't appear until quite late in the development life cycle of that product.
When I ask people what S-Bomb types you support, I get blank faces from vendors.
I get, you mean Cyclone-D-X or S-B-D-X?
We need to educate people to say there are these extra different types,
and we need to ensure that our S-Bombs define which life cycle or where in the life cycle they've been produced.
I think we probably have too many types, and we might not have the right types
to support things like products.
Maybe we need a product based S-Bomb, which pulls all things together.
And we've got things like O-Bombs in Cyclone-D-X, which is like an operational bomb,
is that what we need or do we need other things,
and I think we probably get discussion about that throughout the day.
Trace, normal things to trace me, linked in, get a lot of websites,
and please join me on this journey.
I've enjoyed it for the last four years, and in creating tools,
please let's make the tools better.
Thank you, Anthony, and thank you for keeping it on time.
The next speaker should be getting ready to that, but meanwhile, questions.
Yes, thank you for the great overview of S-Bombs.
One question, and in this type, we need to find that S-Bombs,
and S-Bombs is the product for the S-Bombs.
And what is very strange to me is that in this document,
they don't use their own types.
So this is about S-Bombs.
So I'll repeat the question.
So S-Bombs are not dating in terms of the contents of S-Bombs.
The question we're saying is, they didn't reference the six types of S-Bombs
that I identified in the presentation.
They came up with three different types of names.
I don't know what that, and this is one of it.
The backers may be able to support that.
Until that gets re-issued, I don't know.
As we can see, those six types are widely used currently,
reducing it to three, maybe better, but let's see.
To contest, I didn't have a one-time S-Bombs on my bed at the top.
But I found that this is a few years ago, which I would go out to,
to see if you are seeing these, because the original problem,
I was after it, was not the program of length itself,
I found another problem by looking at the code,
but it was a D-D-C-1.
So, by conceiving the one thing is the program,
I would add it to the same circumstances,
if you can see a beautiful problem,
but if you have to do these things,
and the one type of thing is the advantage of C-Bombs.
Okay?
Yeah, the one is the one that is going to be going to be going to be
going to be matching the value of C-Bombs.
Yeah.
So, the question is saying, they're basically,
sometimes vulnerabilities are only seeing quite late,
on the different ways of seeing,
where you look,
which I think is really the same way,
the one time of the deployed,
or really the level that you need to start seeing that dependencies,
because that's the dynamic nature.
It's great.
Lots of great questions here.
Thank you.
Yes?
Okay, so the question is about my library,
and how I interchange.
It's all my old code.
It's not using any bloody else.
It's not using S-P-D-X or Cyclone-D-X.
Is it possible?
Sorry?
I'll do it.
Okay.
So, the question is, why don't you use protobombs?
Okay, so the question is, why don't you use protobombs?
I started the two before protobombs was invented.
Sorry.
Yes, it is.
If I receive an S-Bombs that is in protobomphoma,
I deal with it,
and the same within Toto,
an S-Bombs embedded as an in Toto,
and I have a chat of it offline.
Okay.
Let's go.
Let's see what's.
See what's.
Victor bombs.
And they're not supported yet.
They're not supported yet.
They're not on my road map to deal.
That's probably the next thing I will deal with.
Okay.
What do you think about the paper?
It's true.
I'll have to stay.
I'll be here all day.
Sure.