What's in a Name - Vulnerabilities, SBOMs, and the Challenge of Software Identity

Explore the critical issue of software identification in the context of supply chain security in this 45-minute conference talk by Justin Murphy from the Department of Homeland Security (DHS), Cybersecurity & Infrastructure Security Agency (CISA). Delve into the challenges posed by multiple naming standards and the gaps between them as the software world and US government aim for automation in mapping dependencies to known vulnerabilities. Examine existing solutions such as CPE, PURL, device identifiers, and hashes, while considering potential risks. Gain insights into collaborative approaches to address this problem over time and learn how the open source community can contribute to improving software identity management for enhanced supply chain security.