Gonda then leads us into the concept of zero trust. Now – zero trust is a buzz word that started out with a specific meaning, but today is used to mean lots of different things. In this interview, Gonda looks at whether and why and how much we should trust our software suppliers, and in turn, how much our customers should trust us. Software Bill of Materials (SBOMs) are a big part of how vendors understand how vulnerable is the software they are buying and embedding into products, and an increasingly big part of how industrial product vendors’ customers look at those vendors products and try to understand how secure they are, and how committed the vendors are to security.

SBOMs, however, used to be seen by most industrial vendors as a trade secret – part of their proprietary intellectual property. Increasingly this is no longer the case, as governments and other customers large and small are demanding visibility into vulnerabilities that might be propagating through the software supply chain. Gonda gives an interesting analogy – she points out that food and beverage vendors are required by law in most jurisdictions to provide consumers with a list of ingredients in all products sold. This is analogous to the SBOM – it is far from a recipe as to how to build the industrial product, it is only a list of ingredients.