Providing Software Bill of Materials (SBOM) is one of the key requirements outlined in the Cyber Resilience Act (CRA) among the other obligations of manufacturers of
products with digital elements made available in the EU market. Given the strict compliance deadlines and the significant penalties for non-conformance, this topic is of interest for the manufacturers and directly beneficial to the ongoing efforts towards CRA compliance.
The generation of Software Bill of Materials (SBOM) from both software (SW) code and binary files often results in different SBOMs, leading to duplicates and
inconsistencies. This discrepancy arises because SBOM tools analyze the source code and binary files differently, capturing distinct sets of dependencies and components. For instance, SW code-based SBOM tools focus on the declared dependencies and libraries used during development, while binary-based SBOM tools analyze the compiled output, identifying all included components, including those not explicitly declared in the source code. This can result in a fragmented view of the software's composition, complicating vulnerability management and compliance efforts. The primary objective is to measure the performance of SBOM tools in the context of both SW code and binary files. The goal is to converge SBOMs originating from binary and open-source sources into a unique, comprehensive list. This involves evaluating the linkage to common vulnerabilities databases and testing the approach in a practical use-case, within Kongsberg Maritime (KM) systems.
The scope includes:
• SBOM tools for binary files and SW code
• Open-source tools
• Previous research on SBOM generation and convergence
Expected deliverables of the project:
• A comparative study of various SBOM tools
• Applicability assessment criteria to determine the requirements for effective SBOM generation
• Proof of concept demonstrating the integration of SBOM tools in a DevSecOps environment
How many: Projects can accommodate two or more students, either working independently or collaboratively.
The SBOM topic is actively discussed by the DevSecOps team at Kongsberg Maritime (KM). Therefore, the student(s) will get the opportunity to collaborate closely with the the company and more specifically with the DevSecOps team! Kongsberg Maritime will cover the necessary travel expenses to KM locations, specifically the KM Carpus site in Kongsberg, where the DevSecOps team is based.
Contact email: xhesika.ramaj@km.kongsberg.com
This project can be either 30 or 60 credits.