Discover the Demo Bill Format for Security to Streamline Your Processes

Demo bill format for Security

[Music] hello and welcome to start left securi platform demonstrations I am part of start left's Securities AI team and we'll be walking you through a series of platform features and why they are important to your organization to have the main feature of this video is s bombs s bomb stands for software bill of materials you can think of an sbom as a detailed inventory of all of your components that make up a software application think of it more as a list of ingredients that tell you what you're shipping as part of your product sbom reports provide visibility into your products components letting you know what they are and where they came from this will give you insights on how are they maintained and what is their risk level for example end of life and end of support information in which the platform can alert and nudge product teams automatically to update instances of code rot or software Decay with the right tool Integrations companies are more focused on risk and understanding what they are deploying in their environments and sbom has become a standard way of being able to provide that information and in some cases it is required to provide that information es bombs show you what is in the application and allow you the ability to be able to share that information to a third party if needed let's Dive Right into our platform and see how our sbom system works here we are looking at at our product dashboard for a particular product in this case called it automation platform is the name of the product very quickly jump into a s bomb view with this view report in the top right click that and it will bring you into a list of your dependencies for a particular application in this case you can see this product has a ton of dependencies we identify the name of the dependency version type of library or framework the open source license identifying license risk within your product here we Define where that particular dependency came from the source as far as what which repository or which code repo and then is there any known risk or known vulnerabilities Associated right to those dependencies along with the severity all the information is here aggregated for your product easily you can sort of filter rule or searchable if you need to look for a particular dependency the product aggregated is crucial as it creates a contextual inventory of all your products the people Associated and the tools used on each product this means start left can correlate the data and S bombs from several code reposit atories associated with a product automatically and whenever code is changed so when a zero day vulnerability comes out you can easily query the SLS system and find where each of those zero day vulnerabilities lives across your entire product portfolio and immediately work with the product owners to manage that risk when you need to generate a sbom report it's simple just click this button we offer you multiple options to extract or export the s bomb information the two standard sbom formats are cyclone DX and spdx primary difference here spdx has been around a lot longer and was the initial sbom concept or format it's primarily focused around enumerating your software dependencies their versions and where they came from that's really it Cyclone DX is sort of spdx on steroids it's much more extensible and covers a lot more use cases you can identify a lot more than just your dependencies and the versions and where they were sourced it contains vulnerability identification what other components or services are in your application and can even be used as far as a ating Cloud Cyclone DX has become the standard simply click either option to generate the report and then it'll be available for download it is as simple as that the main thing we want you to take away from this video besides how well our platform handles s bomb reporting is that s bombs are critical for improving your software security and managing your software risks while also providing transparency to third parties [Music]