SBOM Central - T2 Data

What is SBOM Central?

SBOM Central provides a user-friendly service for managing, monitoring, and sharing your SBOMs. It efficiently identifies and notifies you of vulnerabilities, exploits, and other security concerns while conducting ongoing scans for software updates, licensing compliance, and various health indicators.

What is an SBOM?

A Software Bill of Materials (SBOM) is a document that lists all the software components that are used in a particular software product or application, including both proprietary and open-source components, as well as their version numbers, dependencies, and origins.

Why are SBOMs important?

SBOMs are important tools for enhancing supply chain security, managing software vulnerabilities, ensuring compliance, and making informed decisions about software risk management. They play a crucial role in today’s cybersecurity landscape, where software supply chain attacks are a growing concern.

Improve your supply chain security with SBOM Central.

Upload or create SBOMs

Generate SBOMs at any stage of your development process. Upload each SBOM automatically through the RestAPI and start component identification and security analytics.

You may also upload SBOMs manually through the SBOM Central web interface, or, create SBOMs with the included SBOM tool.

The Artifact Dictionary service will support you when manually creating external artifacts in the Artifact tool.

Analyze and Monitor your SBOMs

SBOM Central performs an in-depth analysis of your SBOMs, delivering real-time insights into their status concerning vulnerabilities, weaknesses, and potential exploits. Additionally, it offers comprehensive component health information, including version details, updates, project activity, licensing, and more.

The service offers continuous monitoring and keeps security and health data for your SBOMs up-to-date. It also provides customizable notifications for specific versions.

You can achieve full traceability for your SBOMs, allowing you to track the evolution of each application and uncover any unexpected dependencies or potential malicious attempts to infiltrate the build process.

Evaluate and prioritize your risk

Vulnerability prioritization involves identifying vulnerabilities and determining their order of remediation by considering factors like potential consequences, exploitability, and additional contextual information such as asset details, severity, business-criticality, and threat intelligence.

The objective is to give priority to addressing high-risk vulnerabilities promptly, while lower-risk ones are addressed in due course, all while aligning with an organization’s unique objectives and risk tolerance.

Share SBOMs, decisions and current status

Recent regulations in both the European Union (EU) and the United States (US) necessitate organizations to implement new policies concerning the disclosure and transparency of software contents. NIS2: ”…. security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;” CRA (Cyber Resilience Act): ”Enhance the transparency of security properties of products with digital elements, and enable businesses and consumers to use products with digital elements securely.”

SBOM Central has powerful features to automate sharing of SBOMs with selected groups of people and organizations. The shared information may include decisions and real-time status regarding vulnerabilities, exploits, and more.

SBOM Central web services

The client application is provided by a web application framework capable of serving multiple tenants. It includes a robust web-based user interface, databases, and a RestAPI specifically crafted for smooth integration with CI/CD automation processes.

SBOM Central information services

The Information Services play a vital role in delivering essential data to web service users, including data regarding vulnerabilities, exploits, patches, software versions, licensing, and more. The Information Services is also a proxy, acting as an intermediary between clients and the Internet, anonymizing requests and protecting privacy.