Tell me about it! We've got slightly under 10'000 distinct software assets we are trying to catalogue. There are now a handful of vendors claiming to be able to scan for crypto, but they all suck.
Tell me about it! We've got slightly under 10'000 distinct software assets we are trying to catalogue. There are now a handful of vendors claiming to be able to scan for crypto, but they all suck.
I'm not even there for my employer. I have compiled a list of ~20 different inventory/CBOM solutions and I cannot even fathom how to move to the next step other than picking a few vendors at random and ask them for a demo, but the public info I found was not convincing.
While I can assume these tools do a decent job at crypto asset discovery (a `grep -r "-----BEGIN RSA PRIVATE KEY-----"` is not the hardest product to design), I have no idea what to do for code scanning. CBOMkit and friends do not scan C code, which we actually need.