2020-031-Allan Friedman, SBOM, software transparency, and knowing how the sausage is made

<p> </p> <p><span style="font-weight: 400;">Ms. Berlin: Tabletop D&D exercise</span></p> <p><span style="font-weight: 400;">Blumira is hiring</span> <a href="https://www.blumira.com/career/lead-backend-engineer/"><span style="font-weight: 400;"> https://www.blumira.com/career/lead-backend-engineer/</span></a><span style="font-weight: 400;"> </span></p> <p><span style="font-weight: 400;">Allan Friedman - Director of Cybersecurity Initiatives, NTIA, US Department of Commerce</span></p> <p><span style="font-weight: 400;">NTIA.gov - National Telecommunications and Information Administration</span></p> <p><a href="https://www.ntia.gov/sbom"><span style= "font-weight: 400;">https://www.ntia.gov/sbom</span></a><span style="font-weight: 400;">  SBOM guidance</span></p> <p><span style="font-weight: 400;">Healthcare SBOM PoC -</span> <a href= "https://www.ntia.gov/files/ntia/publications/ntia_sbom_healthcare_poc_report_2019_1001.pdf"> <span style= "font-weight: 400;">https://www.ntia.gov/files/ntia/publications/ntia_sbom_healthcare_poc_report_2019_1001.pdf</span></a></p> <p><span style="font-weight: 400;">Allan’s talk at Bsides San Francisco:</span> <a href= "https://www.youtube.com/watch?v=9j1KYLfklMQ"><span style= "font-weight: 400;">https://www.youtube.com/watch?v=9j1KYLfklMQ</span></a></p> <p><span style="font-weight: 400;">Questions (more may be added during the show, depending on answers given)</span><span style= "font-weight: 400;"><br /> <br /></span></p> <p><strong>What is NTIA?</strong><strong><br /> <br /></strong></p> <p><strong>What is SBOM?</strong></p> <p><strong>Why do we need one? Is it poor communications between vendors? </strong></p> <p><strong>Is there any difference between “Software transparency” and “Software bill of materials”?</strong></p> <p> </p> <p><strong>How do you make an SBOM? What data formats make sharing easier? What does a company do with an SBOM?</strong></p> <p> </p> <p><strong>Where in the development (hardware or software) would you be creating an SBOM?</strong></p> <p> </p> <p><str