Utilizing Package-URLs for SBOM Management and Vulnerability Tracking

Explore the critical aspects of Software Composition Analysis (SCA) and Software Bill of Materials (SBOM) management in this informative conference talk. Delve into the challenges of identifying and mapping components from supplier SBOMs to internal catalogs and policies. Learn about the importance of consistent software component identification for managing vulnerability risks. Discover how to leverage Package-URLs (PURLs) to standardize SBOM ingestion and automate policy application. Gain insights on utilizing VulnerableCode, a public database of open vulnerability data, to track FOSS vulnerabilities and VEXs using open-source tools and data.

What the &#% Is in That SBOM? How to Provide Users What Software Components Are... - Helio Castro,