Paper Information
- Author
- Eric O'Donoghue,Yvette Hastings,Ernesto Ortiz,A. Redempta Manzi Muneza
- Published
- 6-4-2025
- Affiliation
- Montana State University
- Country
- United States of America
- Conference
Abstract
Software Bill of Materials (SBOMs) are increasingly regarded as essential
tools for securing software supply chains (SSCs), yet their real-world use and
adoption barriers remain poorly understood. This systematic literature review
synthesizes evidence from 40 peer-reviewed studies to evaluate how SBOMs are
currently used to bolster SSC security. We identify five primary application
areas: vulnerability management, transparency, component assessment, risk
assessment, and SSC integrity. Despite clear promise, adoption is hindered by
significant barriers: generation tooling, data privacy, format/standardization,
sharing/distribution, cost/overhead, vulnerability exploitability, maintenance,
analysis tooling, false positives, hidden packages, and tampering. To structure
our analysis, we map these barriers to the ISO/IEC 25019:2023 Quality-in-Use
model, revealing critical deficiencies in SBOM trustworthiness, usability, and
suitability for security tasks. We also highlight key gaps in the literature.
These include the absence of applying machine learning techniques to assess
SBOMs and limited evaluation of SBOMs and SSCs using software quality assurance
techniques. Our findings provide actionable insights for researchers, tool
developers, and practitioners seeking to advance SBOM-driven SSC security and
lay a foundation for future work at the intersection of SSC assurance,
automation, and empirical software engineering.