Man, the CBOM is such a pain. There is no standardised format yet (let alone efficient tools for crypto discovery), nobody knew what it was one year ago but now every client is asking ours anyway.
replyCBOM: Cryptography bill of materials.
replyTell me about it! We've got slightly under 10'000 distinct software assets we are trying to catalogue. There are now a handful of vendors claiming to be able to scan for crypto, but they all suck.
replyI'm not even there for my employer. I have compiled a list of ~20 different inventory/CBOM solutions and I cannot even fathom how to move to the next step other than picking a few vendors at random and ask them for a demo, but the public info I found was not convincing.
replyWhile I can assume these tools do a decent job at crypto asset discovery (a `grep -r "-----BEGIN RSA PRIVATE KEY-----"` is not the hardest product to design), I have no idea what to do for code scanning. CBOMkit and friends do not scan C code, which we actually need.