Software Composition Analysis

Hi All, I am a member of Revenera’s OSPO and cybersecurity teams, and I wanted to make everyone aware that the National Cybersecurity Strategy (https://lnkd.in/gB9Su3mk) was published on March 2nd. Lots of collaboration between the public and private sector went into this strategy and it is a very significant milestone in the ultimate goal of improving the nation's cybersecurity. Whether your organization is a software and/or a software buyer, this is worth following for future developments as new legislation follows the strategy. Here's a few of my initial thoughts: It is great to see references to the importance of SBOMs Make sure your security controls are periodically assessed for conformance with emerging risks as these regulations further evolve Make sure your OSPO and Cybersecurity teams are discussing alignment to mitigate potential product liability problems in the near future For more information, please take a look at how we can help with SBOM Management at https://www.revenera.com/software-composition-analysis/products/sbom-insights.

We are excited to announce the launch of a new SaaS offering to our suite of Software Composition Analysis (SCA) solutions – SBOM Insights. Modern software development stretches beyond your walls. A single application includes various parts from multiple developers and components from external partners—all delivered via different systems from both inside and outside of your organization.   SBOM Insights ingests data from a wide range of sources and then unifies all internal and external SBOMs into a single, actionable view.   CHECK IT OUT This brand-new SaaS technology identifies outdated components, security vulnerabilities, and open-source license compliance issues. It expands the level of transparency into your products beyond the code under your control. We invite you to a webinar on September 27 th for a SBOM Insights introduction. For more information about SBOM Insights, contact us or reach out to your Revenera sales representative.  

What is SBOM Insights? Revenera SBOM Insights is a SaaS inventory management solution that gives organizations the ability to manage security and legal risk by maintaining a complete and accurate SBOM in the cloud. It aggregates the SBOM from multiple data sources—both inside and outside your organization from upstream supply chain partners—and provides full visibility to security and legal teams as well as supply chain partners. With SBOM Insights, you not only have the ability to identify and record all third-party IP through a complete and accurate SBOM, but to collect your SBOM parts from multiple sources—in industry standard SBOM formats (SPDX and CycloneDX). This inventory management solution provides full visibility to all third-party components to designated users within your organization and externally for your customers and downstream supply chain partners at any time. SBOM Insights creates an active repository—with actionable data—of the ingredients withing your software applications.   Will SBOM Insights integrate with other SCA tools or does it require Code Insight? SBOM Insights can ingest data directly from Code Insight via the project data export JSON file. However, it can also import SBOM data from any other SCA tools and SBOM generators in SDPX and/or CycloneDX formats. SBOM Insights is designed to work stand-alone and does not require Code Insight to be installed.   How is Revenera different than other vendors? SBOM Insights is a commercially backed application that comes with the full weight of Revenera’s experienced team of engineers, product managers, services, and support staff. With SBOM Insights you get maintenance and support built into your purchase with a guarantee of security fixes. SBOM Insights goes beyond being a document storage system. It enables you to ingest SBOM data from partners, vendors and suppliers in SPDX and CycloneDX formats, reconcile and normalize the data for a unified view. Furthermore, this advanced technology provides you with insights into the components you use. With everything coming from your enterprise catalogued, when the next high-profile vulnerability hits, you have the unified data at your fingertips to quickly uncover your exposure and expediently fix problems—not just in the code you scanned, but also in all of the software components coming from outside your organization.   Does SBOM Insights replace Code Insight? SBOM Insights is not a replacement for Code Insight. Code Insight (or your designated code scanning solution) is used for the discovery of open source and third-party components for the code under your control. In order to address industry maturity, Revenera is extending our SCA capabilities with SBOM Insights—a SaaS SBOM management solution which unifies and reconciles all SBOM parts coming from both within and outside your organization and gives complete SBOM visibility to whoever in your organization needs to know. SBOMs created from Code Insight (or your code scanning solutions of choice) can be ingested into SBOM Insights. With everything coming from your enterprise catalogued, when the next high-profile vulnerability hits, you have the unified data at your fingertips to quickly uncover your exposure and expediently fix problems—not just in the code you scanned, but also in all of the software components coming from outside your organization.   What is the difference between SBOM Insights and Code Insight? Code Insight is an on-premises software composition analysis solution that helps you discover, assess and manage your license and security risk across your portfolio of applications for the code under your control. It allows you to seamlessly fit compliance checks into your existing Engineering process during component selection, coding, code check-in, and the build. It is an open source and third-party component discovery tool and allows for the continuous scanning, discovery and identification of compliance and security issues. SBOM Insights is your SBOM source of truth, supporting your need to deliver a complete and accurate SBOM regardless of the origin of the SBOM parts—internally or externally from outside vendors and partners. With SBOM insights you get inventory, and the generation of compliance artifacts.   Is there any difference in the users who use SBOM Insights and Code Insight? Not a lot. Typical users of both tools include legal, security, and software development teams. SBOM Insights might also be of interest to your product teams, asset managers, software procurement teams, and partners/third-party vendors. Given SBOM Insights’ roadmap and the potential to deliver on trends and insights, we feel business executives will have interest in the reporting capabilities of the solution to make better business decisions. Customers are also becoming much more savvy about the software supply chain. They want to know more about what solutions they are purchasing and what they are bringing into the organization to support infrastructure needs or what’s being passed on to their customers. Your customers may have an interest in reporting coming from both Code Insight for the codebases under your control and SBOM Insights to extend visibility to SBOM parts coming from outside your organization.

New to SBOM Insights and not sure where to start? Then this article is for you! In this guide, we outline your next steps in order to have a successful journey with SBOM Insights.  Access the Product and Other Product Resources Register for the Revenera Community Using the Account ID and Product ID details from the order confirmation email, sign up for the Revenera Community. Check out our Welcome to the Revenera Community help article for more information. Create your SBOM Insights account and logging in for the first time If you are the original recipient of the order confirmation email, you were automatically sent an invitation to complete creating your SBOM Insights account. If you were not, then your organization administrator can invite you to create a login. Follow the steps outlined in https://docs.revenera.com/sbom_insights/Content/helplibrary/Accepting_Invitations_to_SBOM_Insights.htm to accept the invitation, and https://docs.revenera.com/sbom_insights/Content/helplibrary/Logging_in_to_SBOM_Insights_or_Resetting_Your_Password.htm to log into the application. Get access to the Product and License Center If you are the original recipient of the order confirmation email, you were automatically designated your organization's Product and License Center Administrator (PLC Admin). With the PLC Admin role, you can manage Product and License Center access for your team members once they sign up for the community. This can be done using the Product and License Center User Administration page. If you were not the original recipient of the order confirmation email, you will need to sign up for the community and request access from your PLC Admin. If you do not know who in your organization has the PLC Admin role, please contact Revenera Technical Support for assistance. Download the SBOM Insight reports For the initial release of SBOM Insights, reports are generated outside the product using Python scripts. To download the reports, you need access to the Product and License Center. Once you have gained access to the Product and License Center, navigate to SBOM Insights. From here you can download the SBOM Insights reports. Refer to https://docs.revenera.com/sbom_insights/Content/helplibrary/Generating_SBOM_Insights_Reports.htm for pre-requisites and installation instructions. Access product documentation SBOM Insights documentation can be accessed via https://docs.revenera.com/sbom_insights/Content/helplibrary/SBOM_Insights_root.htm. You can also find it by following the product selector on the Revenera Documentation Site. Stay Up to Date Be sure to subscribe to the SCA News blog to receive product release and other important notifications. Learn More or Get Help The Revenera Community offers a variety of resources to learn about SBOM Insights: Search the SCA Knowledge Base for how-to, FAQs, and problem type articles. The Revenera Learning Center* current hosts several recordings from our live customer events along with several training videos.   If you run into a problem or have questions, you can use the following resources: Open a new case online using the Get Support -> Open New Case* form.  *Note: Requires community login