Is CylcloneDX able to describe a hardware software stack?

[3BK]

Is CylcloneDX able to describe a hardware software stack?

How do we track components such as database servers and databases muchless containers and pods?

Looking at the list of components in CycloneDX, I see: Application, Framework, Operating System, Firmware, Library, Container, Device and file.

then comparing to a simplified hardware stoftware stack, I see: Applications, Middleware, database, operating system, virtual machine, server, storage.

Sorting the components by hardware stack layer - we have:

• application tier:

  • components:
    • Application, Framwork, Library and file

• Middware tier:

  • can we reuse components from the application tier? e.g. application, framework, library and file
  • How do we identify secure web gateways interfaces?
  • how do we identify database drivers?
  • Are we missing a middlware component?
  • Question does the container tier fall under middleware or is it separate?

• Database tier:

  • can we reuse components from the middleware tier?
  • How do we show that the application is dependent on a database server?
  • Are we missing a database server component?
  • How do we show that the application is dependent on a database?
  • Are we missing a database component?
  • How do we show that the dabase is dependent on a group of files?
  • Are we missing a database file group component?

• OS tier:

  • can we reuse components from the database tier?
  • what components are unique to the OS interrupt? Clock? driver?
  • should we add them to the list of components?

• virtual machine tier:

  • what components are unique to the vm tier? vTPM? vClock, VHBA, vNIC?
  • should we add them to the list of components?

• server tier:

  • what components are unique to the server tier? device? Power?
  • should we add them to the list of components?

• storage tier:

  • what components are unique to the storage tier? device? Power?
  • should we add them to the list of components?

[stevespringett]

For hardware, please take a look at https://cyclonedx.github.io/cyclonedx-property-taxonomy/cdx/device and the example that we provide in GitHub. There are also folks from large manufactures that are producing HBOM or have working POCs with CycloneDX HBOMs in the Slack workspace.

Component types are abstract concepts. Please do not think of them as concrete. It would be impossible to come up with a complete taxonomy of different component types. That is not the goal. The goal was to achieve a certain amount of separation of concerns.

Middleware is just another application. If you want to use properties to expand upon that, you can do so. You can also use services to describe the services that the middleware provides or depends on. Same thing for database.

There are a few new component types in v1.5 including platform, device driver, data, and machine learning model.

Storage is a bit odd. We can describe network storage such as S3 or NAS using services. We can also describe the physical storage device. But currently, we cannot describe the volume. That capability is coming with v1.5, but will initially be limited to formulation support, not inventory support.

[3BK]

I'm having trouble seeing how we can describe a on prem BOM much less SaaS using CycloneDX

[3BK]

Hi Steve.
Thanks for your response. I'm still not seeing the database layer. I will embed a dotty graph to illustrate my point.

[jkowalleck]

what do you understand by "database layer"?
is it file-based like SQLite, or is it a DBMS like MySQL, or is it a service like graphQL?
Hope this graph will make it clear, because the answer depends ...

[3BK]

Please see the standard n-tier model.

For example this patent from 2001 Method and apparatus for efficient SQL processing in an n-tier architecture

A true database layer.

• Not a tightly coupled datastore like sqlite or mysql.

A loosely coupled database tier which is fault tolerant.

[3BK]

A real database tier addresses sensor, actuator, bus, and node failure.

[3BK]

digraph G {

srv1_App1 -> srv1;
srv1_App1 -> srv2;
srv1_App1 -> srv3;
srv1_App1 -> srv4;

srv1_App1 -> srv2_App1;

srv1_App1 -> srv1_sw1;
srv1_App1 -> srv2_data1;

srv2_app1_sw1 -> srv1_library;
srv2_app1_sw1 -> srv1_OS;

srv2_App1 -> srv2_app1_sw1;
srv2_App1 -> srv2_app1_data1;

srv2_app1_sw1 -> srv2_library;
srv2_app1_sw1 -> srv2_OS;

srv2_app1_data1 -> srv2_app1_data1_fs1;

srv2_app1_data1_fs1 -> srv2_file1;
srv2_app1_data1_fs1 -> srv2_file2;
srv2_app1_data1_fs1 -> srv2_file3;
srv2_app1_data1_fs1 -> srv2_file4;

srv2_file1 -> srv3;
srv2_file2 -> srv4;
srv2_file3 -> srv3;
srv2_file4 -> srv4;

srv3 -> srv3_dsk1;
srv3 -> srv3_dsk2;
srv3 -> srv3_dsk3;
srv3 -> srv3_dsk4;

srv4 -> srv4_dsk1;
srv4 -> srv4_dsk2;
srv4 -> srv4_dsk3;
srv4 -> srv4_dsk4;

srv3_dsk1 -> srv3_dsk1_fw1;
srv3_dsk1 -> srv3_dsk1_data1;
srv3_dsk2 -> srv3_dsk2_fw1;
srv3_dsk2 -> srv3_dsk2_data1;
srv3_dsk3 -> srv3_dsk3_fw1;
srv3_dsk3 -> srv3_dsk3_data1;
srv3_dsk4 -> srv3_dsk4_fw1;
srv3_dsk4 -> srv3_dsk4_data1;

srv4_dsk1 -> srv4_dsk1_fw1;
srv4_dsk1 -> srv4_dsk1_data1;
srv4_dsk2 -> srv4_dsk2_fw1;
srv4_dsk2 -> srv4_dsk2_data1;
srv4_dsk3 -> srv4_dsk3_fw1;
srv4_dsk3 -> srv4_dsk3_data1;
srv4_dsk4 -> srv4_dsk4_fw1;
srv4_dsk4 -> srv4_dsk4_data1;

}

[3BK]

I mean a database tier such as DB2 HADR, Oracle RAC, SQL Server ALWAYS ON, or Postgresql HA consisting of at least 2 voted nodes.

Maybe 2oo3.
Maybe 2oo4 + 1.

[stevespringett]

Ok. So you need multiple OBOMs. Simple. Each OBOM would reference cooresponding SBOM and HBOM for the assets. That allows you to describe physical assets with hardware, add-ons, operating systems, firmware, applications, etc.

[3BK]

I don't mean a tightly coupled datastore like sqlite or mysql .

I mean a database server. One which earns revenue.

[3BK]

[3BK]

Please note this is a simplified diagram

[stevespringett]

That can easily be represented. What's the question?

[3BK]

Note that the stack needs software and data packages as per CIS and STIG.

[3BK]

Unless you want to call data packages software/firmware which can't be executed. I'm OK with that but it will blow some peoples minds.

[stevespringett]

As I mentioned earlier. Theres a new component type in v1.5 called data.

[3BK]

To elaborate, if you call data software which can't be executed, then what do you a call a register. Something which streams Software ? Then what do you call a demux, something which streams multiple software elements?

[stevespringett]

Why are there so many threads? If you have a question, and related questions, please use threading. It's impossible to keep track of this conversation.

[3BK]

I won't even ask about how we specify the dependency on the HVAC much less single mode fibre.

[stevespringett]

Same way as you would specify dependencies on anything else. You do realize that the CycloneDX data model was inspired by things in the physical supply chain. Specifically pharmaceuticals, but can easily be applied to automotive, etc. In fact, describing the guidance system on an F-35 is a real use case for us. So please do not make assumptions.

[3BK]

Oops. The temperature is 90+ Deg C - BACNET is down. We just fried the equipment due to Electrostatic discharge(ESD) and floating ground. The battery pile caught on fire. And, the pipes burst.

[stevespringett]

Is this suppose to be a question? I don't see how operational constraints belong in a BOM. They do not. However, you can use risk assessment in v1.5 to specify an external location of where those risks are documented at. Or you could use the existing documentation external ref to specify a location where those constraints are documented.

[3BK]

The GPS-R attena can't see any GPS-T satellites. Someone took the Cesium clock - unable to authenticate to the domain. Access control system is DOA - unable to open the door. Fire supression is offline - looking for a stick, some wieners, and some marshmellows. Because they weren't documented in CycloneDX

[stevespringett]

What is the question?

[3BK]

Where are the "45 TB" 8 track tapes? Oops, no one put the firesafe in cycloneDX. I guess we didn't document the HW/SW stack. ;)

[stevespringett]

What is the question?

[3BK]

Let's not even discuss what's included in SaaS. ;)

[stevespringett]

SaaSBOM is a real thing and multiple open source and commercial solutions are available.

[3BK]

[like] Brent Kimberley reacted to your message:

…

________________________________ From: Steve Springett ***@***.***> Sent: Wednesday, June 14, 2023 10:23:28 PM To: CycloneDX/specification ***@***.***> Cc: Brent Kimberley ***@***.***>; Author ***@***.***> Subject: Re: [CycloneDX/specification] Is CylcloneDX able to describe a hardware software stack? (Discussion #243) As I mentioned earlier. Theres a new component type in v1.5 called data. — Reply to this email directly, view it on GitHub<#243 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJXZLIIIR3I2NWTGGN2QZXTXLI2WBANCNFSM6AAAAAAZG2T2JY>. You are receiving this because you authored the thread.Message ID: ***@***.***> THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.

[3BK]

Perfect!

…

________________________________ From: Steve Springett ***@***.***> Sent: Wednesday, June 14, 2023 6:23:28 PM To: CycloneDX/specification ***@***.***> Cc: Brent Kimberley ***@***.***>; Author ***@***.***> Subject: Re: [CycloneDX/specification] Is CylcloneDX able to describe a hardware software stack? (Discussion #243) As I mentioned earlier. Theres a new component type in v1.5 called data. — Reply to this email directly, view it on GitHub<#243 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJXZLIIIR3I2NWTGGN2QZXTXLI2WBANCNFSM6AAAAAAZG2T2JY>. You are receiving this because you authored the thread.Message ID: ***@***.***> THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.