Risk assessment based on augmented software bill of materials
Systems, methods, and software can be used to identify security risks in software code based on Software Bill of Materials (SBOM). In some aspects, a method includes: obtaining, by a server, software code and a SBOM corresponding to the software code; identifying, by the server and based on the SBOM, a library used by the software code; and generating, by the server, a risk assessment based on at least one metric corresponding to the library, where the at least one metric is associated with one or more maintainers of the library.
1. A method, comprising:
obtaining, by a server, software code and a Software Bill of Materials (SBOM) corresponding to the software code, wherein the SBOM comprises information related to a software development standard;
determining, by the server and based on the information related to the software development standard in the SBOM, whether the software code comprises a risk, wherein the software code comprises a component, the component comprises a plurality of subcomponents, and the information in the SBOM comprises a Cybersecurity Assurance Level (CAL) rating of each of the plurality of subcomponents, and wherein determining whether the software code comprises a risk comprises:
determining, by the server, a CAL rating of the component based on the CAL rating of each of the plurality of subcomponents; and
based on determining whether the software code comprises a risk, generating, by the server, a risk assessment of the software code.
2. The method of claim 1 , wherein the information in the SBOM comprises information related to a development process specified in the software development standard, and wherein the method comprises:
determining, by the server and based on the development process, that the software code comprises the risk.
3. The method of claim 2 , wherein determining, by the server and based on the development process, that the software code comprises the risk comprises:
determining, by the server, that the information related to the development process is incomplete; and
in response to determining that the information related to the development process is incomplete, determining that the software code comprises the risk.
4. The method of claim 2 , wherein the development process comprises at least one of a secure software development process, a static application security testing process, a security design assessment, or a static analysis test.
5. The method of claim 1 , wherein the software development standard is a standard for automotive cybersecurity.
6. The method of claim 1 , comprising:
determining, based on the CAL rating, whether to initiate an analysis on the software code to determine whether the software code comprises an additional risk.
7. A computer-readable medium containing instructions which, when executed, cause a computing device to perform operations comprising:
obtaining, by a server, software code and a Software Bill of Materials (SBOM) corresponding to the software code, wherein the SBOM comprises information related to a software development standard;
determining, by the server and based on the information related to the software development standard in the SBOM, whether the software code comprises a risk, wherein the software code comprises a component, the component comprises a plurality of subcomponents, and the information in the SBOM comprises a Cybersecurity Assurance Level (CAL) rating of each of the plurality of subcomponents, and wherein determining whether the software code comprises a risk comprises:
determining, by the server, a CAL rating of the component based on the CAL rating of each of the plurality of subcomponents; and
based on determining whether the software code comprises a risk, generating, by the server, a risk assessment of the software code.
8. The computer-readable medium of claim 7 , wherein the information in the SBOM comprises information related to a development process specified in the software development standard, and wherein the operations comprise:
determining, by the server and based on the development process, that the software code comprises the risk.
9. The computer-readable medium of claim 8 , wherein determining, by the server and based on the development process, that the software code comprises the risk comprises:
determining, by the server, that the information related to the development process is incomplete; and
in response to determining that the information related to the development process is incomplete, determining that the software code comprises the risk.
10. The computer-readable medium of claim 8 , wherein the development process comprises at least one of a secure software development process, a static application security testing process, a security design assessment, or a static analysis test.
11. The computer-readable medium of claim 7 , wherein the software development standard is a standard for automotive cybersecurity.
12. The computer-readable medium of claim 7 , the operations comprising:
determining, based on the CAL rating, whether to initiate an analysis on the software code to determine whether the software code comprises an additional risk.
13. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
obtaining, by a server, software code and a Software Bill of Materials (SBOM) corresponding to the software code, wherein the SBOM comprises information related to a software development standard;
determining, by the server and based on the information related to the software development standard in the SBOM, whether the software code comprises a risk, wherein the software code comprises a component, the component comprises a plurality of subcomponents, and the information in the SBOM comprises a Cybersecurity Assurance Level (CAL) rating of each of the plurality of subcomponents, and wherein determining whether the software code comprises a risk comprises:
determining, by the server, a CAL rating of the component based on the CAL rating of each of the plurality of subcomponents; and
based on determining whether the software code comprises a risk, generating, by the server, a risk assessment of the software code.
14. The computer-implemented system of claim 13 , wherein the software development standard is a standard for automotive cybersecurity.
15. The computer-implemented system of claim 13 , wherein the information in the SBOM comprises information related to a development process specified in the software development standard, and wherein the operations comprise:
determining, by the server and based on the development process, that the software code comprises the risk.
16. The computer-implemented system of claim 15 , wherein determining, by the server and based on the development process, that the software code comprises the risk comprises:
determining, by the server, that the information related to the development process is incomplete; and
in response to determining that the information related to the development process is incomplete, determining that the software code comprises the risk.
17. The computer-implemented system of claim 15 , wherein the development process comprises at least one of a secure software development process, a static application security testing process, a security design assessment, or a static analysis test.