Module 12
Discovery, inventory and CBOM
3 lessonsabout 120 minPractitioner / Advisor
After this module you can
- Design a five-layer discovery program
- Produce a valid CycloneDX CBOM
- Explain honestly where your own vendor stack falls short
Before thisM8: Protocols
- 01Five-layer discovery: network, code, cert, dependency, runtimeName the five layers of a crypto discovery program (network/code/cert/dependency/runtime) and distinguish what each layer finds
- 02CBOM and CycloneDX: the real release historyExplain correctly the current version of CycloneDX (1.7, October 2025) and which CBOM field arrived in which version, correcting the corpus's own wrong version attribution
- 03Crypto-agility: provider models and testabilityExplain, with concrete examples, the common idea behind the OpenSSL providers, JCE and PKCS#11 provider models (separating algorithm choice from code)