Mitigate Security Risk With Real-time Software Bill of Materials

Software runs the world. Deployed across the endpoint environment, it keeps the lights on and helps to drive competitive advantage every minute of every day. But increasingly, it’s comprised of a complex and extensive set of constituent parts from different sources. What happens when a problem is found in one of these components? Leadership teams need to know how extensively the organization is affected. And they need to be assured that risk can be managed swiftly and effectively.

It might take application vendors days to weeks to understand the full details of an affected component in their software, such as the current OpenSSL vulnerability, before customers can even start looking for it across their endpoints. Once Tanium Software Bill of Materials (SBOM) has been deployed to your environment, it takes just seconds to deliver a full software bill of materials in every application on every endpoint.

Watch this short demo video to learn more about Tanium SBOM.

The problem with software

If software is running the world, it is increasingly open-source components that power these applications. A new report estimates that developer requests to the four main open-source ecosystems will exceed 3.1 trillion this year. They’re fuelling an unstoppable wave of DevOps innovation by accelerating time-to-market and helping organizations adapt faster to rapidly changing market demands. But open-source components don’t just find their way into homegrown apps. As Log4j infamously illustrated, proprietary applications are also bursting with third-party code.

Unfortunately, code is written by humans, and humans make mistakes. The average application development project contains 49 vulnerabilities spanning 80 direct dependencies, according to the Linux Foundation. Indirect dependencies are even harder to find. The same report claimed that two-fifths (40%) of all vulnerabilities were found in these transitive dependencies.

Digging deeper

So what happens when a vulnerability in one of these components is found? IT and security teams will soon find that a high-level inventory of all their applications is not enough. They need to be able to unpack dependencies and crack open the “Russian dolls” of compressed files inside those apps to effectively manage risk. Waiting two weeks for a vendor to confirm with their developers whether its products are affected or not is too long a window of opportunity in which the bad guys can strike.

In short, IT teams need to know exactly where an affected component is being used across homegrown and proprietary apps installed on their endpoints. And they need this information at runtime.

Tanium’s Software Bill of Materials

This is the value of Tanium SBOM. From your existing single Tanium agent, it delivers critical real-time visibility into complex software environments, enabling organizations to make better-informed decisions to manage endpoint risk. Tanium empowers customers to:

• Understand every software component at runtime, uncovering software packages and breaking them apart to examine all constituent components without engaging the software vendor. It can probe thick client files and see inside thin client environments.
• Address any vulnerabilities or misconfigurations found in those components.
• Take rapid action to mitigate supply chain risk, by stopping the use of an impacted device, killing relevant processes, or even removing apps completely across affected endpoints.
• Optimize investments in third-party tools like ServiceNow by populating them with granular, accurate and real-time SBOM data.

Complexity is the enemy of cyber risk management. But Tanium SBOM shines a light on the darkest corners of the software supply chain to deliver visibility and control where there is opacity and runaway risk.

---

Tanium SBOM is part of the Asset Discovery and Inventory solution. Learn more and find out how to get visibility into your software supply chain risk today.