SBOMs for the Win! How PSIRT Teams Could Use SBOM
Analysts investigate attack surfaces and defenses concerning SBOMs for the Win! How PSIRT Teams Could Use SBOM.
Summary
Schneider Electric Context
Harish Shankar and Fabrissa present Schneider Electric's product security program. The global energy and automation company operates across 100 countries with thousands of suppliers, integrators, and service partners, making supply-chain security critical.
End-to-End Security Program
Thirteen initiatives cover R&D through customer operations, adopting IEC 62443 standards, global security lab pen testing, source-code governance, secure manufacturing, tamper-proof staging, and field-engineer practices like banning unscanned USBs at customer sites.
SBOM Initiative
Fabrissa describes Schneider's SBOM program for firmware and embedded products with transitive dependencies. The journey began atop an existing product vulnerability management program where R&D teams already tracked component inventories.
PSIRT Integration
Software bill of materials is positioned as a key supply-chain security component enabling PSIRT teams to respond to vulnerabilities across complex products that blend operating systems, embedded software, and cloud components.
Related talks
FIRST·57 min
Analysts investigate attack surfaces and defenses concerning SBOMs - The Missing Link.
S4 Events·41 min
Dave Whitehead
Engineers explore architecture and security mechanisms for Dave Whitehead On SBOMs, Manufacturing in the US, and more.
RSAC Cybersecurity·52 min
Analysts investigate attack surfaces and defenses concerning Tooling up: Getting SBOMs to Scale.