Unraveling Incentives: Understanding the Adoption Barriers of SBOM in the Software Supply Chain

Obtaining novel insights into how a current misalignment of (dis)incentives among business stakeholders in the software supply chain can explain the limited adoption of SBOM

Master thesis (2023)

Authors

B.J.P. Kloeg Technology, Policy and Management

Contributors

M.J.G. van Eeten Organisation & Governance - TPM (coach)
Y. Zhauniarovich Organisation & Governance - TPM (supervisor 1)
Aaron Yi Ding (supervisor 2)
Sjoerd Pellegrom (supervisor 2)
Faculty
Technology, Policy and Management
Copyright: © 2023 Berend Kloeg
More Info
expand_more

Published Date

18-10-2023

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Technology, Policy and Management

Abstract

In today's business landscape, software has become an integral part of operations for all companies, with a growing reliance on third-party components. This increasing complexity in software supply chains has led to a significant reduction in transparency and visibility, posing challenges for effective management and security. Software Bill of Materials (SBOMs) emerges as a promising concept to address this issue by providing detailed information about software components and their supply chain relationships, ultimately enhancing transparency within these supply chains. However, despite its potential benefits, SBOM adoption remains limited in practice.

This research examines the perspectives of four key business stakeholders involved in the software supply chain to understand their incentives and disincentives surrounding SBOM adoption. Through a series of in-depth interviews with representatives from each stakeholder group, we aimed to identify stakeholder-specific risks, benefits, concerns, and incentives related to SBOM adoption. The analysis reveals that SBOM adoption potential is notably higher among system integrators and software vendors. These stakeholders perceive the benefits of enhanced transparency and supply chain risk mitigation, which align with their strategic objectives. On the contrary, B2B customers and Individual Developers exhibit the least motivation for SBOM adoption. Their limited interest stems from a perception that SBOMs may impose additional complexities without commensurate benefits. Given that B2B customers and individual developers are the primary consumers and suppliers of SBOMs, respectively, the findings suggest that the overall adoption potential of this technology remains restricted.