CISA Issues Draft Software Bill of Materials Guide for Public Comment

“This system allowed me to identify missing components when the model validation engine ran. These were components which had infrequent changes and therefore were not commonly documented. The ASSURANT™ model told us that there were some elements missing. When we compared our sources against the model result, we discovered existing legacy components which had previously lacked documentation. The addition of these components to the model has given us confidence in the model’s completeness and improved our cyber readiness.”

“Without the ASSURANT™ attack path analysis visual capability, it’s difficult to explain the complexities of a cyber battlespace to non-experts, and us good guys in the fight are often only learning from our mistakes in the wake of a cyber-attack. The different ways to visualize attack paths allows time to get ahead of the tactics and techniques of cyber actors by allowing us to simulate “black hat” scenarios for when a network artifact becomes compromised.”