InterForm adopts SBOM

To enable ourselves, our customers and partners to identify and mitigate software security vulnerabilities and to comply with legal requirements all InterForm software now includes an SBOM creation.

Software Bill of Materials (SBOM)

Today, all modern software uses libraries, frameworks, code packages, and other third-party components mixed with original code to achieve a particular functionality. Therefore, a Software Bill of Materials (SBOM) detailing the components in the codebase will allow for greater transparency, risk management, and impact analysis.

The concept of a Software Bill of Materials derives from the automotive industry where manufacturers maintain a detailed Bill of Materials for each vehicle. It specifies both original equipment and third-party supplier parts and if a defective part is found, the manufacturer knows exactly which vehicles are affected and can notify and repair rapidly.

Similarly, the InterForm SBOM is a nested inventory of the software building blocks listing:

• Each component’s license type
• Version
• Patch status
• Dependencies between components in the software supply chain*

Why is SBOM important?

At InterForm we work hard to provide our customers and partners with code that is high-quality, compliant, and secure. SBOM enables us to avoid reusing vulnerable components in our software projects and to help our customers better manage their software supply chain risk through knowledge of all InterForm components and their dependencies.

Using an SBOM is also a highly effective strategy for reducing software supply chain cyberattacks, and it demonstrates compliance with data privacy regulations ensuring that the InterForm solution is transparent and trackable.

With the growing complexity of software ecosystems e.g. with more distributed cloud-native applications often composed of hundreds of microservices – each with their own components and dependencies – the task of keeping one’s software portfolio secure and compliant has never been more important. If not properly managed, companies run the risk of introducing fatal security vulnerabilities.

For these reasons, we have adopted the SBOM practice and would recommend all companies select preferred software vendors who can provide their applications’ SBOMs.

If you seek more information on Software Bill of Materials, the National Telecommunications and Information Administration (NTIA) with the United States Department of Commerce has a good collection of materials to study.

Should you have questions about the InterForm SBOM feel free to contact us directly.

*The ‘software supply chain’ of a typical app covers the components, libraries and tools that goes into building and delivering the software to customers. If any of these components have a security flaw, the impact extends to all applications using the component.