OWASP Global AppSec Lisbon 2024

The development of quantum computing and its potential threat to cryptography requires an increased focus on the identification and management of risks associated with cryptography within organizations. The integration of Cryptography Bill of Materials (CBOM) into CycloneDX Software Bill of Materials (SBOM) version 1.6 provides a standardized format for the exchange of cryptographic information from applications to address this issue. The integration of CBOM into the existing software supply chain security framework is essential to gain insight into the cryptographic components used in applications. This presentation will introduce the use of CBOM for cryptography representation within software supply chain initiatives and discuss how it can facilitate cryptographic governance and promote cryptographic agility.