TY - GEN
T1 - The Benefits of a Software Bill of Materials Program at Nuclear Facilities
AU - Eggers, Shannon L.
AU - Morgan, Baleigh R.
AU - Christensen, Drew N.
AU - Simon, Tori B.
AU - Bauer, Ethan S.
N1 - Funding Information:
This work was supported by the U.S. DOE Office of Nuclear Energy Cybersecurity Crosscutting Technology Development Program under the DOE Idaho Operations Office, Contract DE-AC07-05ID14517.
Publisher Copyright:
© 2023 American Nuclear Society, Incorporated.
PY - 2023
Y1 - 2023
N2 - Software supply chain attacks are becoming increasingly more prevalent in both information communications technology and operational technology environments. Often, a supplier or other entity discloses vulnerability information about software components and subcomponents used in a digital asset, but an asset owner is unable to quickly ascertain if the vulnerable component is installed in their facility. The generation and use of a software bill of materials (SBOM) for installed digital assets can enable an asset owner to quickly identify if and where a component is used, allowing them to evaluate the risk and determine necessary risk treatments. The integration of an SBOM program into a nuclear facility not only improves vulnerability management and risk management processes, it also benefits asset and configuration management, cybersecurity, supply chain programs. This paper reviews the U.S. Department of Energy Office of Nuclear Energy Cybersecurity and Crosscutting Technology Development program’s work on integrating an SBOM program into a nuclear facility. It also provides a discussion on the benefits of such a program.
AB - Software supply chain attacks are becoming increasingly more prevalent in both information communications technology and operational technology environments. Often, a supplier or other entity discloses vulnerability information about software components and subcomponents used in a digital asset, but an asset owner is unable to quickly ascertain if the vulnerable component is installed in their facility. The generation and use of a software bill of materials (SBOM) for installed digital assets can enable an asset owner to quickly identify if and where a component is used, allowing them to evaluate the risk and determine necessary risk treatments. The integration of an SBOM program into a nuclear facility not only improves vulnerability management and risk management processes, it also benefits asset and configuration management, cybersecurity, supply chain programs. This paper reviews the U.S. Department of Energy Office of Nuclear Energy Cybersecurity and Crosscutting Technology Development program’s work on integrating an SBOM program into a nuclear facility. It also provides a discussion on the benefits of such a program.
KW - SBOM
KW - software bill of materials
UR - https://www.scopus.com/pages/publications/85183315481
UR - https://www.mendeley.com/catalogue/94091919-671e-35a8-9434-c109206bd501/
U2 - 10.13182/NPICHMIT23-42305
DO - 10.13182/NPICHMIT23-42305
M3 - Conference contribution
AN - SCOPUS:85183315481
T3 - Proceedings of 13th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies, NPIC and HMIT 2023
SP - 885
EP - 894
BT - Proceedings of 13th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies, NPIC and HMIT 2023
PB - American Nuclear Society
T2 - 13th Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies, NPIC and HMIT 2023
Y2 - 15 July 2023 through 20 July 2023
ER -