SEP 14, 2022 | US
Industry Cautions on Software Security Regs in the Defense Bill
Nextgov, September 14, 2022
By Chris Riotta
Technology trade groups are aligning against a proposal in the House-passed defense policy bill that would require software vendors to attest to the government that their products are free of known defects and to include a bill of materials describing their code.
The groups – the Alliance for Digital Innovation, BSA | The Software Alliance, the Cybersecurity Coalition and the Information Technology Industry Association – say that the legislation leapfrogs ongoing administrative efforts to establish software bills of materials (SBOMs) as part of the federal acquisition process. Those efforts, the groups say, are still in their developing stages and there isn't a consistent approach to SBOMs – essentially ingredient lists that tell what proprietary and open source components are included in software application.
"Ultimately, SBOMs will not achieve the desired utility for agencies at this point because of a lack of standardization," the groups said in a Sept. 14 letter to the heads of multiple committees of Congress. "This highlights the need for additional work to include guidance on the structure and construction of an SBOM and standardization of the processes for SBOM dissemination, ingestion, and use."
Original Posting: https://www.nextgov.com/cxo-briefing/2022/09/industry-cautions-software-security-regs-defense-bill/377148/
À PROPOS DE BSA
BSA | The Software Alliance (www.bsa.org) est le principal organisme de défense et de promotion de l’industrie du logiciel auprès des administrations gouvernementales et sur le marché international. Ses membres comptent parmi les entreprises les plus innovantes au monde, à l’origine de solutions logicielles qui stimulent l’économie et améliorent la vie moderne.
Basée à Washington, DC et présente dans plus de 30 pays, BSA est pionnière en matière de programmes de conformité qui encouragent l’utilisation légale de logiciels et plaide en faveur de politiques publiques à même de promouvoir l’innovation technologique et de favoriser la croissance économique numérique.