Patrick Dwyer -- CycloneDX and SBOMs

Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project. A lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis. Patrick Dwyer is a senior product security engineer in the application security team at ServiceNow. He's also co-leader of the OWASP CycloneDX project, a lightweight software bill of materials standard designed for use in application security contexts and supply chain component analysis. Patrick joins us to help us understand how CycloneDX fits into the world of protecting your software supply chain. He explains why they started the project and what is the depth and breadth of it, how many people are using it, and what is the future for CycloneDX and software supply chain.The Application Security Podcast is brought to you by Security Journey.About Security JourneyPatrick Dwyer is a senior product security engineer in the application security team at ServiceNow.→ Learn more about Security JourneyConnect with Patrick Dwyer:→ CycloneDX→ ServiceNowMentioned in this episode:→ CycloneDX→ ServiceNow→ CycloneDX→ OWASP Dependency-Track→ SPDX→ Docker→ JC Herz and Steve Springett -- SBOMs and software supply chain assuranceFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Patrick Dwyer: CycloneDX and SBOMs05:07 Awesome. So I want to, I want to transition into talking07:36 I guess what was the need when this project was started10:01 So, so they have kind of different functions then. So I12:12 Cool. So let's back up for a second. I probably got14:10 Yeah, I'm also seeing the value then of retrieving SBOMs in18:41 How'd you get involved with this then, with the CycloneDX project19:52 Very cool. Very cool. So I mentioned kind of at the—23:21 Yeah, that's, that's great to hear. What do you see as25:11 Yeah, I guess as the tooling continues to improve and the