Answer 'are we affected?' from a bill of materials

applied · 75 min · Objective 2.2

Task

Produce a software bill of materials for something you build, then use it to answer the question that matters when a widely used library turns out to be vulnerable: are we affected, where, and how fast can we say so.

Steps

  1. Create a small project with a dependency file you write by hand — a requirements.txt with half a dozen pinned versions, or the equivalent for a language you prefer.
  2. Generate an inventory of the components and their exact versions into /tmp/sbom.csv with the columns component,version,source,direct. Mark whether each is a direct dependency or pulled in by another.
  3. Now simulate the announcement: pick one component in your list and declare a vulnerability in versions below a stated number.
  4. Write /tmp/affected.sh: a script that reads the SBOM and prints every component whose version is below the stated threshold, with a non-zero exit if any are found.
  5. Run it and record how long the answer took. Compare that with how long it would take without the inventory — searching machines one at a time.
  6. Extend the SBOM with a where_deployed column naming which of your lab VMs run it, because 'we use it' and 'it is running in production' are different answers to the regulator's question.

Verify

awk -F, 'NR>1 && NF>=4 {n++} END {print n" component(s) inventoried"}' /tmp/sbom.csv
bash /tmp/affected.sh; echo "affected.sh exit: $?"
awk -F, 'NR>1 && $2 !~ /[0-9]/ {n++} END {print (n+0)" component(s) with no version"}' /tmp/sbom.csv

The first must be at least six. The second must exit non-zero while the vulnerable version is pinned, and zero after you bump it — run it both times, because a script that always reports 'affected' is not answering the question. The third must be 0: an SBOM entry without an exact version cannot answer 'are we affected', which is the only question it exists to answer.

Notes

The timing comparison is the finding. Organisations without an inventory spend days on this question while the exploitation window is open, and the answer they eventually give is 'we think so'. The SBOM turns it into a query, and that is its entire value.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.