+3.2 SBOM General Risks

3.2 SBOM General Risks

Complementary to the identification of threats, this section presents some general risks that jeopardise the SBOM accuracy, integrity and operationalisation. Table 6 lists indicative risk scenarios, their potential impact and suggested mitigation activities.

RiskRisk ScenarioPotential impactIndicative Mitigation

Activities

Non-standardised SBOM FormatSBOMs generated usingReduced interoperability between producers and consumers.
  • Generate SBOMs using established standards, such as SPDX or CycloneDX
Generate SBOMs
a proprietary, custom,using established
unstructured, orstandards, such as
otherwise non-SPDX or CycloneDX

interoperable format.

SBOM in a Non-Machine-Readable FormatSBOMs provided only inReduced automation
  • SBOMs in a machine-readable format suitable for automated processing
a format intendedand scalability of SBOM
primarily for humanconsumption and
consumption.inability to automatically correlate components

with vulnerability

databases.

Incomplete SBOMComponents or dependencies are not fully covered by the SBOM.Vulnerabilities remain undiscovered and software inventory is incomplete.
  • Automatic generation

at release

  • CI/CD integration
  • Documented treatment

of known unknowns and

missing metadata

Outdated SBOMThe SBOM no longer reflects the current version of the software.Insufficient vulnerability
  • Regenerate SBOMs based on the above identified triggers

management and

inaccurate risk

assessment.

Poor component identificationComponents are not uniquely identified across ecosystems.Inaccurate vulnerability correlation and matching.Use standardised

ecosystem-aware

component identifiers.

  • Use repository URL

from upstream source

repository, OR

  • Use Package URL

combined with

namespace, exact

version, and

cryptographic hashes

where applicable OR

  • Use CPE, following

naming convention

consistently with

namespace, exact

version and

cryptographic hashes

where applicable

Insufficient SBOM AccuracySBOM generation toolsExcessive vulnerability alerts and alert fatigue due to false-positive components, missed vulnerabilities due to omitted or incorrectly identified components and/ or incorrect vulnerability matching.
  • Select appropriate SBOM generation techniques according to the software ecosystem, build process, artifact type, and intended SBOM use case,
  • Validate generated SBOMs against S/W artifacts,
  • Perform completeness and accuracy checks,
  • Validate component identifiers

relying on heuristic

analysis to identify

components and

dependencies, generate

SBOMs that may contain

components that are not

actually present or used

(false positives), omit

components that are

present (false

negatives), or incorrectly

report versions,

dependency

relationships, or

identifiers.

Weak SBOM-to-Artifact BindingSBOMs not strongly andIncorrect SBOM may be used for vulnerability analysis increasing false positives or false negatives in vulnerability matching.
  • Cryptographically bind
unambiguouslythe SBOM to the exact
associated with theartifact using a
exact software artifact,cryptographic hash or
build, release, containerimmutable digest
image, or package that it
  • Verify the SBOM-to-
describes.artifact association
Limited SBOM operationalizationSBOMs are generated but not integrated into the SDLC.Reduced value from SBOM adoption and ineffective vulnerability management.
  • Consume SBOMs for

asset management,

vulnerability

management, license

compliance etc.

Insufficient SBOM Retention and Lifecycle EvidenceFailure to retain historical SBOMs and their associated evidence (e.g. previous SBOM versions, build identifiers, artifact digests, signatures, VEX documents) for an adequate period.Inability to determine whether historical or deployed software versions contain a newly discovered vulnerable component.
  • Define an SBOM

retention policy

  • Retain SBOMs per

release

  • Maintain version

history

  • Maintain SBOM-to-

artifact traceability

  • Define lifecycle

disposal procedures

Lack of vulnerability prioritizationEvery vulnerability identified through the SBOM is treated equally without considering exploitability.Vulnerability overflooding and delayed remediation of highly targeted vulnerabilities.
  • Combine SBOM data

with VEX to assess

exploitability and

reachability

  • Incorporate asset

criticality and exposure

  • Establish risk-based

vulnerability prioritization

process

Table 6 - SBOM General Risks

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

Zahteve

3. Povezani predpisi

Predpisi