Standardizing the Delivery of a Software Bill of Materials with Platform One

Stuxnet malware destroyed Iran’s nuclear centrifuges by altering the rotational speed by increments undetectable to humans. Cyber attacks with nation-state backing have produced this and other examples of adversarial danger.  It is very possible for an adversary to carry out the destruction, detonation, or launch of our ICBMs. In order to understand where software comes from, validate its pedigree, and attest to its components, a Software Bill of Materials (SBOM) must be consistently generated. An SBOM could have prevented the Stuxnet virus from infiltrating the nuclear facility.   The logical end state of SBOM at Platform One will involve deep integration with Platform One's flagship product: Big Bang.  While the production of a SBOM can vary depending on variable factors such as "where", "who", "what" as well as having variable formats for creation, we will document all techniques that have real-world use cases today as it relates to the applicability to the approach that will meet AFNWC's need in consuming of a Platform One provided SBOM.  This will likely result in targeted output parameters dependent on the type of software and the mechanisms that compile any given software component within the Platform One ecosystem.