Examkin

Soru

Zorluk: OrtaThird-Party Risk Management and Supply Chain Oversight

An organization's security team is enhancing its software supply chain risk management practices for newly acquired third-party applications. To proactively verify that external vendor applications do not introduce known vulnerabilities from embedded open-source libraries, which of the following artifacts should the organization require vendors to provide?

  1. A Software Bill of Materials (SBOM)Cevap
  2. B
    A Business Impact Analysis (BIA)
  3. C
    An Interconnection Security Agreement (ISA)
  4. D
    A Service Level Agreement (SLA)

Cevap

The organization should require vendors to provide a Software Bill of Materials (SBOM).
Requiring a Software Bill of Materials (SBOM) allows organizations to maintain continuous visibility into the component libraries and open-source software embedded within vendor-supplied applications. This inventory is critical for analyzing supply chain risks and reacting promptly when vulnerabilities are discovered in common upstream libraries.

Adım Adım Çözüm

1
Identify the primary security concern in the scenario
The core requirement is identifying hidden vulnerabilities in third-party software and open-source libraries integrated into vendor products.
Supply chain security risks often stem from nested open-source dependencies contained within compiled or distributed software packages.
2
Evaluate the appropriate supply chain governance artifact
A Software Bill of Materials (SBOM) provides a complete nested inventory of code components, libraries, and modules.
Having an SBOM enables security teams to correlate identified component versions against known vulnerability databases (such as CVEs).

Anahtar Kavram

Software Bill of Materials (SBOM) in Supply Chain Security
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Third-Party Risk Management and Supply Chain Oversight

Bu konudan daha fazla soru