Analysis of software bill of materials tools

Arushi Arora and Christina Garman
Additional contact information
Arushi Arora: Researcher, National and Homeland Security, Idaho National Laboratory, USA
Christina Garman: Assistant Professor, Computer Science, Purdue University, USA

Cyber Security: A Peer-Reviewed Journal, 2023, vol. 6, issue 4, 334-355

Abstract: Modern software development has gradually become more complex, leveraging available open-source software and third-party components. This practice has raised questions about the provenance, licensing, versioning and compliance of reused code and its dependencies. Furthermore, it is particularly important to review such code fragments and third-party components for known vulnerabilities before they are included in a software product. A Software Bill of Materials (SBoM) is a mechanism to achieve such an analysis, providing transparency and visibility into a software product to both the software developer and its respective consumer. SBoM lists information and details about all the elements constituting a piece of software and can, therefore, be used to evaluate associated security risk. While the concept of SBoM is growing in popularity, it is still fairly new to many organisations, causing them to potentially struggle with producing and processing SBoM and limiting their widespread adoption. In this work, we delve into the area of SBoM and present state-of-the-art SBoM tools, creating a framework for analysis and categorising them based on a diverse set of features and functionalities. We are the first to provide a detailed analysis of 83 open-source SBoM tools along with a perspective on how potential SBoM users can select a tool based on their specific requirements. Our work aims to help promote understanding of this domain, thereby encouraging and furthering its overall adoption. We additionally seek to pave a path for future work in this area by providing recommendations to tool developers and users, researchers and standardising organisations.

Keywords: software bill of materials (SBoM); software supply chain security; SBoM tools (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2023
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/7926/download/ (application/pdf)
https://hstalks.com/article/7926/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2023:v:6:i:4:p:334-355

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().