SBOM graph database aims to be cloud security secret sauce – TechTarget

“Conventional database schemata tend to lend themselves to unintentionally destroying historical information,” he said. “[If] you can’t reconstruct your knowledge of the world at [a given] point in time … you can’t know for certain whether you made a decision that was sensible.”

Allowing for this historical analysis is in keeping with GUAC’s mission to provide a system that’s useful for both proactive and reactive security, as described in the Cloud Native SecurityCon presentation by Lewis.

“GUAC can apply to a lot of different aspects of discoverability and auditing across the lifecycle of a vulnerability, from the reactive, [determining] how you’re affected by something that’s actually happened … [to] the proactive, trying to understand the wider security implications of different artifacts and which artifacts need more attention,” Lewis said.

This kind of comprehensive approach could ultimately make cloud-native security more effective than traditional security, said Melinda Marks, an analyst at TechTarget’s Enterprise Strategy Group.

“There’s always going to be vulnerabilities at runtime,” Marks said. “When those things happen, you need to be able to act quickly, and if you have that information on which developer did what, it makes it a lot more efficient than if you’re only monitoring the runtime environment.”

SBOM database as public good

Software supply chain security products that encompass cloud-native apps are available from vendors such as Rezilion, but Chester said he believes such systems should be offered as a public good by vendor-neutral groups such as the Open Source Security Foundation (OpenSSF).

OpenSSF already hosts a public instance of the Sigstore software signing project, and given a general lack of skilled experts in cutting-edge graph databases, it might have to do similar for GUAC in the future, Chester said.

“Most of the world’s knowledge graph experts are working for one of the [tech] giants,” he said. “You need a custodian in whom people can place trust that they won’t bend it to proprietary advantage.”

So far, the project is not governed by any specific open source foundation, and with Google at its helm, it’s still an open question whether GUAC will follow the path of Kubernetes, which formed the basis for the CNCF, or of Knative and Istio, which took years for Google to donate to CNCF.

Marks said she believes GUAC will go the Kubernetes route.

“It’s in their interest to say, ‘This is what we’re using. We’re sharing it, we want you to build on it, we want more vendors involved,'” she said. “It’s smart for them to take a leading stance on this.”

Beth Pariseau, senior news writer at TechTarget Editorial, is an award-winning veteran of IT journalism. She can be reached at bpariseau@techtarget.com or on Twitter @PariseauTT.