Software Transparency

CHAPTER 5Challenges in Software Transparency

Early in the discussion in the National Telecommunications and Information Administration (NTIA) software bill of materials (SBOM) initiatives, the topic of SBOMs for devices arose as a complicated factor. Currently, the consensus is that SBOM is such a new concept for many organizations that complicating the discussion is undesirable. After all, isn't device software and firmware just software?

Firmware and Embedded Software

We'll break up this category into a few discussion areas: firmware as an operating system, firmware for embedded devices, and the topic of how SBOMs are used in certain device-specific scenarios such as medical devices.

Linux Firmware

Firmware as an operating system, especially as it relates to Linux firmware, is the most easily understood, but it's important to note that these are very complex SBOMs. Linux is essentially thousands of software products cobbled together to form an operating system. As such, it may be challenging to obtain the level of clarity needed to gain transparency into that software. But this is one of the easier problems to solve in this space. Many of the tools we see for Linux tend to do little more than run a Red Hat Package Manager (RPM) command, unless the image is processed by large-scale reverse engineering processes or SBOMs are produced on a per-software-object level as part of the build process. The reality is that there's so much fragmentation in the way Linux OSs are built ...