CBOM sawv cev rau Cryptographic Bill of Materials. Nws yog ib daim ntawv teev cov khoom muaj nqis uas muaj cov qauv, nyeem tau los ntawm lub tshuab ntawm txhua yam khoom muaj nqis cryptographic hauv ib daim ntawv thov lossis lub kaw lus: cov algorithms, qhov loj me tseem ceeb, daim ntawv pov thawj, cov tsev qiv ntawv cryptographic, thiab cov txheej txheem siv, nrog rau lawv cuam tshuam li cas rau cov khoom siv uas siv lawv. Qhov twg a Cov Ntaub Ntawv Txog Software (SBOM) cov lus teb "cov lej twg nyob hauv daim ntawv thov no," CBOM teb cov lus nug nqaim dua thiab, rau ntau lub koom haum, cov lus nug nyuaj dua: "cryptography khiav qhov twg, thiab hom twg."
Lub ntsiab lus ntawm CBOM, hauv cov lus yooj yim #
Feem ntau cov pab pawg kev ruaj ntseg tuaj yeem tsim cov npe tiav ntawm cov tsev qiv ntawv qhib uas lawv cov software vam khom. Tsawg dua tuaj yeem teb qhov twg RSA-2048 tseem siv, cov kev pabcuam twg vam khom SHA-1, lossis dab tsi yuav tawg yog tias TLS 1.0 raug kaw tag kis. Qhov sib txawv ntawd yog qhov CBOM kaw. Nws tsis yog hom cryptography tshiab thiab tsis yog lub cuab yeej scanning los ntawm nws tus kheej: nws yog qhov tso zis, daim ntawv qhia sau tseg ntawm kev siv cryptographic thoob plaws hauv codebase, lub tsev, lossis tag nrho thaj av.
Feem ntau, CBOM sau cov ntaub ntawv no:
- Algorithms thiab lawv cov kev teeb tsa: cov txheej txheem encryption thiab kos npe, qhov loj me tseem ceeb, hom cipher (piv txwv li, cim RSA-1024 lossis CBC-xwb cipher suites li qub lawm)
- Daim ntawv povDaim ntawv pov thawj X.509, lawv cov neeg muab daim ntawv pov thawj, thiab hnub tas sij hawm
- Cov yuam sij thiab cov ntaub ntawv cryptographiccov yuam sij pej xeem, ntiag tug, thiab zais cia, cov vectors pib, thiab cov ntaub ntawv cuam tshuam
- Cov tsev qiv ntawv Cryptographic thiab cov modules: lub tsev qiv ntawv twg siv cov algorithm uas tau muab, thiab nws cov version
- kev cai: TLS, IPsec, thiab lwm yam kev ruaj ntseg protocols siv, suav nrog cov versions deprecated uas tseem ua haujlwm
- kev sib raug zoo: cov khoom twg hu rau lub tsev qiv ntawv twg, thiab cov txheej txheem twg vam khom rau cov algorithm twg hauv qab nws
CBOM vs. SBOM: qhov txawv yog dab tsi #
An SBOM teev cov khoom siv software thiab lawv cov kev vam khom. CBOM nqaim dua thiab tob dua: nws siv cov cryptography hauv cov khoom ntawd thiab piav qhia nws hauv cov lus cryptographic SBOM yeej tsis tau tsim los ntes. Daim ntawv teev npe vam khom tuaj yeem qhia koj tias daim ntawv thov siv lub tsev qiv ntawv TLS tshwj xeeb; nws yuav tsis qhia koj tias cov ntaub ntawv cipher twg uas lub tsev qiv ntawv tau teeb tsa los tso cai, lossis seb daim ntawv pov thawj tom qab nws puas yuav tas sij hawm. Qhov tseeb, ob qho no yog sib pab. Cov koom haum uas muaj kev paub tab SBOM kev xyaum muaj qhov pib ua ntej ntawm CBOM, vim tias tib txoj kev tshawb pom uas qhia cov khoom sib txuas tuaj yeem nthuav dav mus rau qhia cov cryptography uas cov khoom siv ntawd siv.
Vim li cas nws tseem ceeb tam sim no #
Peb qhov kev nyuaj siab sib cais tab tom thawb cov khoom muag cryptographic los ntawm qhov zoo-yuav tsum muaj mus rau qhov yuav tsum tau sau tseg:
Kev siv cryptography tom qab quantum (PQC) kev tsiv teb tsaws chaw. Ua ntej ib lub koom haum tuaj yeem hloov pauv ntawm kev siv cov txheej txheem cryptography, nws xav tau daim ntawv qhia tseeb ntawm qhov chaw siv cov txheej txheem cryptography ntawd. CBOM yog daim ntawv qhia ntawd. Nws cia pab pawg kev ruaj ntseg tsom mus rau PQC pilot precisely (piv txwv li, txhua qhov kev pabcuam siv daim ntawv pov thawj uas tau muab los ntawm CA tshwj xeeb ntawm RSA-2048) thiab taug qab kev nce qib ntawm kev tsiv teb tsaws chaw dhau sijhawm, es tsis txhob kwv yees ntawm qhov kev cuam tshuam.
Kev txawj ntse ntawm crypto. Cov algorithms uas tsis siv lawm thiab cov kev teeb tsa tsis muaj zog tsis tshaj tawm lawv tus kheej. Ib qho CBOM qhia txog kev siv SHA-1, qhov ntev ntawm tus yuam sij luv, lossis TLS 1.0/1.1 tseem qhib, yog li ib pab neeg tuaj yeem muab qhov tseem ceeb rau qhov uas siv tau tiag tiag es tsis txhob tshuaj xyuas tes los ntawm ib lub tshuab.
Kev tswj hwm lub zog. Lub tswv yim tau hloov pauv ntawm kev coj ua zoo tshaj plaws ntawm AppSec mus rau qhov yuav tsum tau ua ntawm tsoomfwv. Thaum Lub Rau Hli 22, 2026, Tsev Dawb tau kos npe rau Executive Order 14412, "Kev Ruaj Ntseg Lub Tebchaws Tiv Thaiv Kev Tawm Tsam Cryptographic Advanced," uas tau hais kom CISA thiab NIST yuav tshaj tawm cov ntsiab lus tsawg kawg nkaus rau CBOM hauv 270 hnub, thawj zaug uas daim ntawv teev cov ntaub ntawv cryptographic tau raug xaiv los ua cov khoom cuav hauv txoj cai tswjfwm tebchaws. NIST tus kheej PQC kev taw qhia txog kev tsiv teb tsaws chaw pom zoo kom sib koom ua ke SBOM nrog CBOM thaum cov koom haum npaj rau cov algorithms quantum-safe.
Yuav ua li cas CBOM raug tsim tawm #
Lub tswv yim tau pib los ua qhov kev txuas ntxiv ntawm CycloneDX SBOM standard, tswj hwm nyob rau hauv OWASP, uas ntxiv ib hom khoom siv crypto-asset tshwj xeeb hauv CycloneDX v1.6. Cov khoom ntawd sau cov cryptographic primitive, variant, thiab hom siv, nrog rau API hu thiab code qhov chaw uas kev ua haujlwm cryptographic tshwm sim, cia CBOM raug tsim tib txoj kev. SBOM yog: los ntawm kev tshuaj xyuas static ntawm cov lej qhov chaw, kev vam khom qhia, thiab, nce ntxiv, kev tshuaj xyuas binary rau cov xwm txheej uas qhov chaw tsis muaj.
Hauv kev xyaum, kev tsim kom muaj CBOM uas siv tau nyob ntawm tib hom kev tshuaj xyuas software uas twb siv rau SBOM tiam, txuas ntxiv mus kom paub txog kev hu xov tooj rau lub tsev qiv ntawv cryptographic, cov lej tswj daim ntawv pov thawj, thiab kev teeb tsa protocol, tom qab ntawd sib raug zoo nrog cov qhov tsis muaj zog uas paub (cov algorithms tsis siv lawm, cov yuam sij luv luv, daim ntawv pov thawj tas sij hawm lossis sai sai no yuav tas sij hawm) yog li cov khoom muag dhau los ua ib yam dab tsi uas pab pawg neeg tuaj yeem ua haujlwm es tsis yog daim ntawv teev npe tsis hloov pauv.
Qhov uas CBOM tsis them #
Ib daim CBOM piav qhia txog yam uas tau tsim rau hauv daim ntawv thov cov lej thiab kev vam khom. Nws tsis, los ntawm nws tus kheej, ntes cov kev teeb tsa ua haujlwm xws li cov sijhawm hloov pauv tseem ceeb, kev siv cov khoom siv ruaj ntseg kho vajtse, lossis kev siv zog ua haujlwm cipher suite ntawm lub server nyob. Ib qho kev ua tiav cryptographic ua ke CBOM nrog cov ntsiab lus ua haujlwm ntawd; CBOM yog cov khoom pib, tsis yog tag nrho daim duab.
Xygeni's ASPM platform tsim CBOM nrog rau ib qho SBOM thiab AI-BOM ua ib feem ntawm nws cov khoom muag sib koom ua ke, yog li kev pheej hmoo cryptographic nyob hauv tib lub zeem muag zoo li lwm qhov ntawm koj daim ntawv thov kev ruaj ntseg.
FAQ #
Tsis yog, txawm hais tias cov lus luv tau siv ob txoj kev keeb kwm. Qee cov chaw ua haujlwm, suav nrog cov khoom siv kho mob, tau siv "cybersecurity bill of materials" los piav qhia txog cov khoom lag luam kev ruaj ntseg dav dua. Hauv AppSec thiab software supply chain zej zog, CBOM tam sim no hais txog cov khoom muaj nqis cryptographic.
An SBOM ib leeg xwb yuav tsis qhia koj tias cov algorithms, qhov loj me, lossis daim ntawv pov thawj twg siv, tsuas yog cov khoom thiab cov tsev qiv ntawv twg muaj. CBOM ntxiv txheej ntawd. Ntau pab pawg tsim CBOM ua qhov txuas ntxiv ntawm qhov uas twb muaj lawm SBOM qhov kev pab cuam es tsis yog ua ib qho kev siv zog sib cais los ntawm kos.
Cov kev cai tab tom tshwm sim es tsis yog daws teeb meem. Daim Ntawv Txiav Txim Siab 14412 (Lub Rau Hli 2026) yog thawj txoj cai los xaiv CBOM ncaj qha, qhia CISA thiab NIST los txhais cov ntsiab lus tsawg kawg nkaus, nrog rau kev taw qhia xav tias yuav muaj nyob rau thaum ntxov xyoo 2027. Tsis muaj ISO/IEC standard rau CBOM tseem muaj. Hom ntawv siv niaj hnub no yog CycloneDX CBOM extension.
Txhua lub koom haum uas npaj yuav hloov chaw cryptography tom qab quantum, ua haujlwm hauv ib qho chaw tswj hwm uas kev huv cryptographic raug tshuaj xyuas, lossis raug rau cov kev cai tshiab ntawm tsoomfwv cryptographic-inventory yuav tsum kho CBOM kev tsim tawm ua qhov tseem ceeb rau lub sijhawm luv luv es tsis yog yav tom ntej.
