SBOM

Case study: Log4Shell (CVE-2021-44228)

How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.

Release, Maintenance · Developers, AppSec engineers

Generate an SBOM for the software you actually release

Define the inventory boundary, compare build and artifact evidence, and connect the resulting SBOM to an immutable release.

Release · Developers, AppSec engineers, Platform engineers and SREs

Choose SBOM formats and identify components accurately

Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.

Release · Developers, AppSec engineers

Review SBOM changes between releases

Turn inventory differences into explainable release decisions without confusing generator changes with software changes.

Release · AppSec engineers, Platform engineers and SREs

Use VEX without losing vulnerability evidence

Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.

Release, Maintenance · AppSec engineers

Open source license compliance: SPDX expressions, obligations and SBOM checks

Know which licenses you ship, read SPDX license expressions correctly, meet the obligations of common licenses for the way you distribute, and enforce a license policy in CI from the SBOM.

Development, Release, Security program · AppSec engineers, Security leaders

Harden container images from Dockerfile to admission

Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.

Development, Release, Maintenance · Developers, Platform engineers and SREs

Supplier software assurance: check SOC 2 reports, SBOMs and signed updates against your use

Connect supplier claims to product scope, supported versions, release integrity and vulnerability handling before making a procurement decision.

Release, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

Compliance evidence reuse: one evidence set for SSDF, PCI DSS, ISO 27001, SOC 2 and the CRA

Keep one set of release-bound engineering evidence (SBOM, provenance, review records, scan results, ASVS results and vulnerability handling) and map it to several frameworks: a worked crosswalk, an evidence index checked in CI with a CSV export, and an OSCAL component definition.

Release, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

SBOM completeness lab: Find the dependencies missing from a release SBOM

A release SBOM lists only direct dependencies. The shipped artifact also contains a bundled parser and a transitive helper. Repair the comparison so inventory omissions remain visible.