Re: [Rats] Implementation report

["Friedman, Allan" <[e-mail]>]

Lovely to be pulled into the cool standards kids group!

Always happy to chat more about where SBOM sits today, and where there’s room for trying to help layer trust on without breaking some of the existing efforts.

On the hardware side, I’ll also flag that a whole lot of people are interested in a more holistic approach to hardware transparency side, and there may be some public calls for more information and ideas coming soon. Some work that happened at CISA (https://www.cisa.gov/resources-tools/resources/hardware-bill-materials-hbom-framework-supply-chain-risk-management ) highlighted the challenge of meaningful cross-organization supply chain visibility even before you get to the trust and trust anchor pieces.

allan (the SBOM guy)

From: Tom Jones <[e-mail]>
Date: Friday, February 23, 2024 at 2:40 PM
To: Henk Birkholz <[e-mail]>
Cc: Kathleen Moriarty <[e-mail]>, rats <[e-mail]>, John Schmidt <[e-mail]>, Sean Turner <[e-mail]>, Friedman, Allan <[e-mail]>
Subject: Re: [Rats] Implementation report
CAUTION: This email originated from outside of DHS. DO NOT click links or open attachments unless you recognize and/or trust the sender. Contact your component SOC with questions or concerns.

We are exploring the use of SBOM in OWF.
The last time I raised anything like that in a RATS thread I was met with outright hostility.
..tom


On Wed, Feb 21, 2024 at 3:11 AM Henk Birkholz <[e-mail]> wrote:
Hi Kathleen,

thank you for the pointers! Will you be in Brisbane?

Looking at your last link, I am wondering if there are plans for future
projects. Say... remote attestation based authenticity assurance in the
software supply chain chain: and I am thinking along the lines of
"Trustworthy SBOMs", which would be scenario that would combine various
building blocks and that is definitely still in demand of more standards
consolidation.

Because
https://learn.cisecurity.org/built-in-security-scale-hardware-support<https://urldefense.us/v3/__https:/learn.cisecurity.org/built-in-security-scale-hardware-support__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzOoZwUZw$>
cited https://www.cisa.gov/securebydesign, I am reeling Alan into this
reply. So that he is aware that we could do something meaningful here :-)


Viele Grüße,

Henk

On 13.02.24 15:58, Kathleen Moriarty wrote:
> Greetings!
>
> Last year, I introduced my team to RATS work and pulled together a
> project that was a lead in to the attestation sets draft, implementing
> largely what's described in
> https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/<https://urldefense.us/v3/__https:/datatracker.ietf.org/doc/draft-ietf-rats-endorsements/__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7PcIVlM$>
> <https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/<https://urldefense.us/v3/__https:/datatracker.ietf.org/doc/draft-ietf-rats-endorsements/__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7PcIVlM$>>
>
> It took some time to complete due to some hyperscaler environments not
> having a TPM or access to it from the container orchestration platform
> or virtual server host. Once we secured an environment where this was
> possible, through use of the IMA libraries (created for this purpose and
> previously proven by RedHat), positive results were demonstrated. The
> objective was to test assurance to CIS Benchmarks as that was my
> employer at the time. We hope you find this report useful.
>
> https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical<https://urldefense.us/v3/__https:/www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzwhBhTTg$> <https://www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical<https://urldefense.us/v3/__https:/www.rsaconference.com/Library/blog/automated-assurance-on-a-path-to-becoming-practical__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzwhBhTTg$>>
>
> This was done at the same time other team members were researching the
> prevalence of TPMs and TEEs in infrastructure. The purpose of that work
> was to signal that hardware support is increasingly available and should
> be used to ease configuration management and posture assurance capabilities.
>
> https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support<https://urldefense.us/v3/__https:/www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7ddhyPc$> <https://www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support<https://urldefense.us/v3/__https:/www.cisecurity.org/insights/white-papers/built-in-security-at-scale-through-hardware-support__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGz7ddhyPc$>>
>
> The timeline could include more data points, we included key points.
>
> I am copying John Schmidt who did the work. Sean Turner joined the
> project in September and assisted with key management, application of
> cryptography, and validation. Thank you both for your great work to
> successfully implement this PoC!
>
> --
>
> Best regards,
> Kathleen
>
> _______________________________________________
> RATS mailing list
> [e-mail]<mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/rats<https://urldefense.us/v3/__https:/www.ietf.org/mailman/listinfo/rats__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzo4pHZ_4$>

_______________________________________________
RATS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/rats<https://urldefense.us/v3/__https:/www.ietf.org/mailman/listinfo/rats__;!!BClRuOV5cvtbuNI!FY6abhShH0gjKfhgUwQQJTDGccUOOxh5ZYquJkiDN7Xcov7Y2OtWVyAUCUU_FW9s7AbNZY08Tyrkuyb9-_v3EgZAmWGzo4pHZ_4$>