Leveraging SBOMs to Enhance ICS Security
Tom Pace explores leveraging Software Bills of Materials (SBOMs) to track third-party dependencies and supply chain risks in embedded ICS devices.
Summary
The Supply Chain Blindspot in Industrial Control Systems
Industrial control devices often embed dozens of legacy third-party software libraries and firmware stacks (such as Ripple20 and Urgent/11) without asset owner visibility.
Understanding Software Bills of Materials (SBOMs)
Tom Pace reviews federal executive orders and NTIA guidance defining machine-readable SBOM formats (SPDX, CycloneDX) for tracking component dependencies.
Generating and Consuming SBOMs for Embedded Hardware
Pace demonstrates automated tools for generating SBOMs from firmware binaries and integrating them into enterprise vulnerability management platforms.
Operationalizing SBOMs for Rapid Vulnerability Triage
The author illustrates how asset owners can instantly determine whether newly disclosed zero-days affect their deployed operational technology fleets.
Related talks
Community Stage·53 min
Tom Berek · Farid Zakaria · D Baker
Explores how Nix and NixOS provide reproducible software builds, declarative dependency management, and SBOM traceability across homelabs and enterprise environments.
Community Stage·53 min
Tom Berek · Farid Zakaria
Tom Berek and Farid Zakaria dive into reproducible builds, Nixpkgs dependency isolation, and SBOM verification using Nix and NixOS.
Creator Stage·24 min
Allan Friedman
Makes the case for Hardware Bills of Materials (HBOMs) to trace semiconductor provenance, detect component cloning, and secure hardware supply chains.