Weaving the [X]BOM Fabric - Erica Dretzka , Department of Defense
Channel: The Linux Foundation
Date: 2023-05-25

Weaving the [X]BOM Fabric - Erica Dretzka , Department of Defense

Today's supply chains are composed of a hybrid of proprietary and open-source elements extending geographically, temporally, technically, and organizationally. Consumers struggle to evaluate compliance with security standards, licensing regulations, and vulnerability analysis. Recent motivating examples include malicious code infiltration into SolarWinds' Orion, remote code execution vulnerabilities and Apache lLog4j, and the discovery that a component in the F-35 fighter jet originated from China halting delivery. Legacy Bills of Materials (BOMs) remain relevant for modern supply chain illumination of all asset types, thus the proposed eXtensible Bill of Material ([x]BOM) pattern to digitize BOMs with the [x] representing a type of BOM. The resulting [x]BOM Fabric flattens the narrative between boardroom and edge operations, superseding domain specificity via malleable metadata patterns and data structures. Working across the supply chain, the authors are prototyping [x]BOMs, thus demonstrating universality from definition to implementation, and, ultimately, germaneness across mission use cases, at scale, in space, and across the supply chain, enabling AI and M&S analyses, threat vector predictions, and decision causality analysis. It scales for flexible research and analysis.