An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead

• Published in: Proceedings / International Conference on Software Engineering pp. 2630 - 2642
• Main Authors: Xia, Boming, Bi, Tingting, Xing, Zhenchang, Lu, Qinghua, Zhu, Liming
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.01.2023
• Subjects: bill of materials; Bills of materials; empirical study; Industries; responsible AI; Roads; SBOM; Security; Software; software bill of materials; Supply chains; Surveys
• ISSN: 1558-1225
• DOI: 10.1109/ICSE48619.2023.00219

The rapid growth of software supply chain attacks has attracted considerable attention to software bill of materials (SBOM). SBOMs are a crucial building block to ensure the transparency of software supply chains that helps improve software supply chain security. Although there are significant efforts from academia and industry to facilitate SBOM development, it is still unclear how practitioners perceive SBOMs and what are the challenges of adopting SBOMs in practice. Furthermore, existing SBOM-related studies tend to be ad-hoc and lack software engineering focuses. To bridge this gap, we conducted the first empirical study to interview and survey SBOM practitioners. We applied a mixed qualitative and quantitative method for gathering data from 17 interviewees and 65 survey respondents from 15 countries across five continents to understand how practitioners perceive the SBOM field. We summarized 26 statements and grouped them into three topics on SBOM's states of practice. Based on the study results, we derived a goal model and highlighted future directions where practitioners can put in their effort.