Measuring the Security of the Evolving Software Supply Chain: a Research Agenda
Researchers propose a unified cross-ecosystem measurement agenda for software supply chain security, targeting dependency modeling and AI-generated dependency patterns.
The paper argues that existing quantitative measurement and vulnerability management approaches for software supply chain security are fragmented and ecosystem-specific, limiting comparable risk assessments. It lays out a research agenda starting with a Systematization of Knowledge to expose gaps in dependency modeling, transitive dependency treatment, and real-world exploitability of vulnerabilities. It further warns that AI-assisted development with coding LLMs will create dependency patterns not captured by traditional Software Composition Analysis tools, motivating a rethink of dependency modeling.
- Current supply chain risk measurement is fragmented per ecosystem
- SoK planned to expose dependency modeling and propagation gaps
- Transitive dependency exploitability is under-analyzed
- Coding LLMs may create dependency patterns invisible to SCA tools
From the original article
1 min read at arxiv.orgSoftware supply chain security has become increasingly critical due to the widespread reliance on third-party dependencies and the growing attack surface of modern software ecosystems. However, existing quantitative, measurement-based analysis and vulnerability management approaches remain largely fragmented and ecosystem-specific, limiting their ability to provide comparable risk assessments across environments.
By Sarah Meriem Ourari · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.