{"id":"https://openalex.org/W4417063400","doi":"https://doi.org/10.1145/3733827.3765526","title":"Establishing a Baseline of Software Supply Chain Security Task Adoption by Software Organizations","display_name":"Establishing a Baseline of Software Supply Chain Security Task Adoption by Software Organizations","publication_year":2025,"publication_date":"2025-10-13","ids":{"openalex":"https://openalex.org/W4417063400","doi":"https://doi.org/10.1145/3733827.3765526"},"language":"en","primary_location":{"id":"doi:10.1145/3733827.3765526","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3733827.3765526","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2509.08083","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5028171895","display_name":"Laurie Williams","orcid":"https://orcid.org/0000-0003-3300-6540"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Laurie Williams","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":"https://orcid.org/0000-0003-3300-6540","affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011814210","display_name":"Sammy Migues","orcid":null},"institutions":[{"id":"https://openalex.org/I4210090186","display_name":"Sterling Research Group","ror":"https://ror.org/009prea33","country_code":"US","type":"facility","lineage":["https://openalex.org/I4210090186"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Samuel Migues","raw_affiliation_strings":["Imbricate Security, Sterling, VA, USA"],"raw_orcid":"https://orcid.org/0009-0003-3291-8457","affiliations":[{"raw_affiliation_string":"Imbricate Security, Sterling, VA, USA","institution_ids":["https://openalex.org/I4210090186"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.45789789,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"26","last_page":"36"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4065999984741211,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4065999984741211,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11864","display_name":"Supply Chain Resilience and Risk Management","score":0.2669000029563904,"subfield":{"id":"https://openalex.org/subfields/1408","display_name":"Strategy and Management"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.02329999953508377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.6026999950408936},{"id":"https://openalex.org/keywords/supply-chain","display_name":"Supply chain","score":0.5989999771118164},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.49480000138282776},{"id":"https://openalex.org/keywords/package-development-process","display_name":"Package development process","score":0.4546000063419342},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.453000009059906},{"id":"https://openalex.org/keywords/social-software-engineering","display_name":"Social software engineering","score":0.44679999351501465},{"id":"https://openalex.org/keywords/software-peer-review","display_name":"Software peer review","score":0.4325000047683716},{"id":"https://openalex.org/keywords/personal-software-process","display_name":"Personal software process","score":0.42890000343322754},{"id":"https://openalex.org/keywords/supply-chain-risk-management","display_name":"Supply chain risk management","score":0.3889000117778778},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.37070000171661377}],"concepts":[{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.6026999950408936},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.5989999771118164},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.49480000138282776},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.49410000443458557},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.47600001096725464},{"id":"https://openalex.org/C123551368","wikidata":"https://www.wikidata.org/wiki/Q7122888","display_name":"Package development process","level":5,"score":0.4546000063419342},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.453000009059906},{"id":"https://openalex.org/C182500959","wikidata":"https://www.wikidata.org/wiki/Q7551380","display_name":"Social software engineering","level":5,"score":0.44679999351501465},{"id":"https://openalex.org/C74579156","wikidata":"https://www.wikidata.org/wiki/Q7554342","display_name":"Software peer review","level":5,"score":0.4325000047683716},{"id":"https://openalex.org/C39890963","wikidata":"https://www.wikidata.org/wiki/Q1702721","display_name":"Personal software process","level":5,"score":0.42890000343322754},{"id":"https://openalex.org/C192639820","wikidata":"https://www.wikidata.org/wiki/Q1114469","display_name":"Supply chain risk management","level":5,"score":0.3889000117778778},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.37299999594688416},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.37070000171661377},{"id":"https://openalex.org/C44104985","wikidata":"https://www.wikidata.org/wiki/Q492886","display_name":"Supply chain management","level":3,"score":0.36719998717308044},{"id":"https://openalex.org/C51845450","wikidata":"https://www.wikidata.org/wiki/Q1421651","display_name":"Team software process","level":5,"score":0.36169999837875366},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.35659998655319214},{"id":"https://openalex.org/C40919944","wikidata":"https://www.wikidata.org/wiki/Q947779","display_name":"Software project management","level":5,"score":0.3553999960422516},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.35019999742507935},{"id":"https://openalex.org/C171981572","wikidata":"https://www.wikidata.org/wiki/Q7554239","display_name":"Software analytics","level":5,"score":0.35010001063346863},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.34700000286102295},{"id":"https://openalex.org/C175133352","wikidata":"https://www.wikidata.org/wiki/Q1254596","display_name":"Software as a service","level":4,"score":0.3393999934196472},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.31949999928474426},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C180152950","wikidata":"https://www.wikidata.org/wiki/Q2904257","display_name":"Software development process","level":4,"score":0.31060001254081726},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.3102000057697296},{"id":"https://openalex.org/C76518257","wikidata":"https://www.wikidata.org/wiki/Q271680","display_name":"Software framework","level":5,"score":0.30720001459121704},{"id":"https://openalex.org/C48306297","wikidata":"https://www.wikidata.org/wiki/Q7554352","display_name":"Software quality management","level":5,"score":0.3025999963283539},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.298799991607666},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.298799991607666},{"id":"https://openalex.org/C44416564","wikidata":"https://www.wikidata.org/wiki/Q7554199","display_name":"Software Engineering Process Group","level":5,"score":0.2987000048160553},{"id":"https://openalex.org/C110354214","wikidata":"https://www.wikidata.org/wiki/Q6314146","display_name":"Engineering management","level":1,"score":0.2897000014781952},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.28679999709129333},{"id":"https://openalex.org/C125900194","wikidata":"https://www.wikidata.org/wiki/Q3516888","display_name":"Software review","level":5,"score":0.28529998660087585},{"id":"https://openalex.org/C176035894","wikidata":"https://www.wikidata.org/wiki/Q7554350","display_name":"Software quality control","level":5,"score":0.26989999413490295},{"id":"https://openalex.org/C101317890","wikidata":"https://www.wikidata.org/wiki/Q940053","display_name":"Software maintenance","level":4,"score":0.2694999873638153},{"id":"https://openalex.org/C54534927","wikidata":"https://www.wikidata.org/wiki/Q4462275","display_name":"Software requirements","level":5,"score":0.2597000002861023},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.25929999351501465},{"id":"https://openalex.org/C174683762","wikidata":"https://www.wikidata.org/wiki/Q609588","display_name":"Component-based software engineering","level":4,"score":0.257999986410141},{"id":"https://openalex.org/C21491501","wikidata":"https://www.wikidata.org/wiki/Q430253","display_name":"Backporting","level":5,"score":0.25}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3733827.3765526","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3733827.3765526","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2509.08083","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2509.08083","pdf_url":"https://arxiv.org/pdf/2509.08083","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2509.08083","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2509.08083","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2509.08083","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2509.08083","pdf_url":"https://arxiv.org/pdf/2509.08083","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5914965034","display_name":"Collaborative Proposal: SaTC: Frontiers: Enabling a Secure and Trustworthy Software Supply Chain","funder_award_id":"2207008","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Software":[0,32,70],"supply":[1,14,33,51,109,122,147,170],"chain":[2,15,34,52,110,123,148,171],"attacks":[3,16],"have":[4,86,141],"increased":[5],"exponentially":[6],"since":[7],"2020.":[8],"The":[9,88,150,181],"primary":[10],"attack":[11,187],"vectors":[12,188],"for":[13],"are":[17,196],"through:":[18],"(1)":[19],"software":[20,30,50,96,108,117,121,137,146,163,169,190],"components;":[21],"(2)":[22],"the":[23,57,65,101,153,160,166,185,193,198],"build":[24,194],"infrastructure;":[25],"and":[26,192],"(3)":[27],"humans":[28],"(a.k.a":[29],"practitioners).":[31],"risk":[35,111,124],"management":[36,125],"frameworks":[37,61],"provide":[38],"a":[39],"list":[40],"of":[41,59,68,90,103,116,152,201,204],"tasks":[42,58,83,105,164,182,206],"that":[43,106,140,156,183],"an":[44,113],"organization":[45],"can":[46,72],"adopt":[47],"to":[48,94],"reduce":[49,107],"risk.":[53,149],"Exhaustively":[54],"adopting":[55],"all":[56],"these":[60,205],"is":[62,93,178],"infeasible,":[63],"necessitating":[64],"prioritized":[66],"adoption":[67,102],"tasks.":[69],"organizations":[71,98,139,157,177],"benefit":[73],"from":[74],"being":[75],"guided":[76],"in":[77,99,120,176,197],"this":[78,91],"prioritization":[79],"by":[80],"learning":[81],"what":[82],"other":[84],"teams":[85],"adopted.":[87],"goal":[89],"study":[92,115,129],"aid":[95],"development":[97,138],"understanding":[100],"security":[104],"through":[112,189],"interview":[114,128],"practitioners":[118,134],"engaged":[119],"efforts.":[126],"An":[127],"was":[130],"conducted":[131],"with":[132],"61":[133],"at":[135],"nine":[136],"focused":[142],"efforts":[143],"on":[144,168],"reducing":[145],"results":[151],"interviews":[154],"indicate":[155],"had":[158],"implemented":[159],"most":[161],"adopted":[162],"before":[165],"focus":[167],"security.":[172],"Therefore,":[173],"their":[174],"implementation":[175],"more":[179],"mature.":[180],"mitigate":[184],"novel":[186],"components":[191],"infrastructure":[195],"early":[199],"stages":[200],"adoption.":[202],"Adoption":[203],"should":[207],"be":[208],"prioritized.":[209]},"counts_by_year":[],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2025-10-10T00:00:00"}