{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:43:41Z","timestamp":1785512621496,"version":"3.56.0"},"publisher-location":"New York, NY, USA","reference-count":53,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"NWO","award":["NWA.1215.18.006"],"award-info":[{"award-number":["NWA.1215.18.006"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,7]]},"DOI":"10.1145\/3634737.3637659","type":"proceedings-article","created":{"date-parts":[[2024,6,28]],"date-time":"2024-06-28T11:51:38Z","timestamp":1719575498000},"page":"1770-1783","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["Charting the Path to SBOM Adoption: A Business Stakeholder-Centric Approach"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-2764-270X","authenticated-orcid":false,"given":"Berend","family":"Kloeg","sequence":"first","affiliation":[{"name":"Northwave Cyber Security, Utrecht, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4173-031X","authenticated-orcid":false,"given":"Aaron Yi","family":"Ding","sequence":"additional","affiliation":[{"name":"TU Delft, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-9602-4371","authenticated-orcid":false,"given":"Sjoerd","family":"Pellegrom","sequence":"additional","affiliation":[{"name":"Northwave Cyber Security, Utrecht, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9116-0728","authenticated-orcid":false,"given":"Yury","family":"Zhauniarovich","sequence":"additional","affiliation":[{"name":"TU Delft, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,7]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[n. d.]. A distributed vulnerability database for Open Source. Retrieved 2023-08-14 from hhttps:\/\/osv.dev\/"},{"key":"e_1_3_2_1_2_1","unstructured":"2021. Executive Order 14028: Improving the Nation's Cybersecurity. Retrieved 2023-08-18 from https:\/\/www.federalregister.gov\/documents\/2021\/05\/17\/2021-10460\/improving-the-nations-cybersecurity"},{"key":"e_1_3_2_1_3_1","unstructured":"2023. Whisper: Robust Speech Recognition via Large-Scale Weak Supervision. Retrieved 2023-07-26 from https:\/\/github.com\/openai\/whisper"},{"key":"e_1_3_2_1_4_1","unstructured":"Tom Alrich. 2022. The purl in your future. Retrieved 2023-07-30 from https:\/\/tomalrichblog.blogspot.com\/2022\/11\/the-purl-in-your-future.html"},{"key":"e_1_3_2_1_5_1","unstructured":"Tom Alrich. 2023. From the NVD to the IVD. Retrieved 2023-06-07 from https:\/\/tomalrichblog.blogspot.com\/2023\/05\/from-nvd-to-ivd.html"},{"key":"e_1_3_2_1_6_1","unstructured":"Tom Alrich. 2023. Is it time to abandon VEX? Retrieved 2023-08-14 from https:\/\/tomalrichblog.blogspot.com\/2023\/07\/is-it-time-to-abandon-vex.html"},{"key":"e_1_3_2_1_7_1","unstructured":"Tom Alrich. 2023. The problem with VEX documents. Retrieved 2023-07-12 from https:\/\/tomalrichblog.blogspot.com\/2023\/06\/the-problem-with-vex-documents.html"},{"key":"e_1_3_2_1_8_1","unstructured":"Tom Alrich. 2023. The Procurement use case for SBOMs. Retrieved 2023-08-01 from https:\/\/tomalrichblog.blogspot.com\/2023\/05\/the-procurement-use-case-for-sboms.html"},{"key":"e_1_3_2_1_9_1","article-title":"Strengthening the Security of Operational Technology: Understanding Contemporary Bill of Materials","volume":"3","author":"Arora Arushi","year":"2022","unstructured":"Arushi Arora, Virginia L Wright, and Christina Garman. 2022. Strengthening the Security of Operational Technology: Understanding Contemporary Bill of Materials. Journal of Critical Infrastructure Policy 3, 1 (2022).","journal-title":"Journal of Critical Infrastructure Policy"},{"key":"e_1_3_2_1_10_1","unstructured":"Tingting Bi Boming Xia Zhenchang Xing Qinghua Lu and Liming Zhu. 2023. On the Way to SBOMs: Investigating Design Issues and Solutions in Practice. arXiv:2304.13261 [cs.SE]"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1191\/1478088706qp063oa"},{"key":"e_1_3_2_1_12_1","volume-title":"An empirical comparison of dependency network evolution in seven software packaging ecosystems. Empirical Software Engineering 24, 1 (01","author":"Decan Alexandre","year":"2019","unstructured":"Alexandre Decan, Tom Mens, and Philippe Grosjean. 2019. An empirical comparison of dependency network evolution in seven software packaging ecosystems. Empirical Software Engineering 24, 1 (01 Feb 2019), 381--416."},{"key":"e_1_3_2_1_13_1","volume-title":"Baleigh Rae Morgan, and Ethan S Bauer.","author":"Eggers Shannon Leigh","year":"2022","unstructured":"Shannon Leigh Eggers, Drew Christensen, Tori Brooke Simon, Baleigh Rae Morgan, and Ethan S Bauer. 2022. Towards Software Bill of Materials in the Nuclear Industry. Technical Report. Idaho National Laboratory (INL)."},{"key":"e_1_3_2_1_14_1","unstructured":"Rishab A Ghosh Ruediger Glott Bernhard Krieger and Gregorio Robles. 2002. Free\/libre and open source software: Survey and Study. Part IV: Survey of developers. Retrieved 2023-08-14 from https:\/\/www.math.unipd.it\/~bellio\/FLOSS%20Final%20Report%20-%20Part%204%20-%20Survey%20of%20Developers.pdf"},{"key":"e_1_3_2_1_15_1","unstructured":"Shmuel Gihon. 2023. What You Need to Know About the 3CX Supply Chain Attack. Retrieved 2023-07-26 from https:\/\/cyberint.com\/blog\/research\/3cx-supply-chain-attack\/"},{"key":"e_1_3_2_1_16_1","volume-title":"Identification of Software Bill of Materials in Container Images. Master's thesis","author":"Girdhar Shubham","unstructured":"Shubham Girdhar. 2022. Identification of Software Bill of Materials in Container Images. Master's thesis. Frankfurt University of Applied Sciences."},{"key":"e_1_3_2_1_17_1","unstructured":"GitHub. [n. d.]. GitHub Sponsors: Invest in the software that powers your world. Retrieved 2023-08-01 from https:\/\/github.com\/sponsors"},{"key":"e_1_3_2_1_18_1","unstructured":"Elias Groll and John Hewitt Jones. 2022. Software bills of material face long road to adoption. Retrieved 2023-08-18 from https:\/\/cyberscoop.com\/dhs-sbom-adoption\/"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2010.12.001"},{"key":"e_1_3_2_1_20_1","unstructured":"Jessica Lyons Hardcastle. 2023. MOVEit Body Count Closes in on 400 Orgs 20M+ Individuals. Retrieved 2023-07-26 from https:\/\/www.theregister.com\/2023\/07\/20\/moveit_victim_count\/"},{"key":"e_1_3_2_1_21_1","unstructured":"Stephen Hendrick. 2022. The State of Software Bill of Materials (SBOM) and Cybersecurity Readiness. Retrieved 2023-08-18 from https:\/\/www.linuxfoundation.org\/research\/the-state-of-software-bill-of-materials-sbom-and-cybersecurity-readiness"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Udo Kuckartz. 2019. Qualitative Text Analysis: A Systematic Approach. 181--197.","DOI":"10.1007\/978-3-030-15636-7_8"},{"key":"e_1_3_2_1_23_1","unstructured":"Linux Foundation. [n. d.]. Software Package Data Exchange (SPDX). Retrieved 2023-08-14 from https:\/\/spdx.dev\/"},{"key":"e_1_3_2_1_24_1","unstructured":"Steve Marquess. 2014. Of Money Responsibility and Pride. Retrieved 2023-08-14 from http:\/\/veridicalsystems.com\/blog\/of-money-responsibility-and-pride\/"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.18280\/ijsse.110505"},{"key":"e_1_3_2_1_26_1","unstructured":"Caley McGillvary. 2022. Thematic Analysis: an Overview. Retrieved 2023-08-18 from https:\/\/getthematic.com\/insights\/thematic-analysis-overview\/"},{"key":"e_1_3_2_1_27_1","volume-title":"Towards secure software development at Neste - a case study. Master's thesis","author":"Moroz Anton","unstructured":"Anton Moroz. 2022. Towards secure software development at Neste - a case study. Master's thesis. University of Helsinki."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2019.09.283"},{"key":"e_1_3_2_1_29_1","unstructured":"National Institute of Standards and Technology. [n. d.]. National Vulnerability Database (NVD). Retrieved 2023-08-14 from https:\/\/nvd.nist.gov\/"},{"key":"e_1_3_2_1_30_1","unstructured":"National Telecommunications and Information Administration. 2019. Roles and Benefits for SBOM Across the Supply Chain. Retrieved 2023-07-20 from https:\/\/ntia.gov\/sites\/default\/files\/publications\/ntia_sbom_use_cases_roles_benefits-nov2019_0.pdf"},{"key":"e_1_3_2_1_31_1","unstructured":"National Telecommunications and Information Administration. 2021. Vulnerability-Exploitability eXchange (VEX) - An Overview. Retrieved 2023-08-14 from https:\/\/ntia.gov\/sites\/default\/files\/publications\/vex_one-page_summary_0.pdf"},{"key":"e_1_3_2_1_32_1","unstructured":"NTIA Formats and Tooling Working Group. 2021. Software Consumers Playbook: SBOM Acquisition Management and Use. Retrieved 2023-07-25 from https:\/\/ntia.gov\/sites\/default\/files\/publications\/software_consumers_sbom_acquisition_management_and_use_-_final_0.pdf"},{"key":"e_1_3_2_1_33_1","unstructured":"NTIA Formats and Tooling Working Group. 2021. Software Suppliers Playbook: SBOM Production and Provision. Retrieved 2023-07-25 from https:\/\/ntia.gov\/sites\/default\/files\/publications\/software_suppliers_sbom_production_and_provision_-_final_0.pdf"},{"key":"e_1_3_2_1_34_1","unstructured":"NTIA Multistakeholder Process on Software Component Transparency Framing Working Group. 2021. Software Identification Challenges and Guidance. Retrieved 2023-07-30 from https:\/\/ntia.gov\/sites\/default\/files\/publications\/ntia_sbom_software_identity-2021mar30_0.pdf"},{"key":"e_1_3_2_1_35_1","volume-title":"ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses. 15--24","author":"Okafor Chinenye","unstructured":"Chinenye Okafor, Taylor R. Schorlemmer, Santiago Torres-Arias, and James C. Davis. 2022. SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties. In ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses. 15--24."},{"key":"e_1_3_2_1_36_1","unstructured":"OWASP. [n. d.]. OWASP CycloneDX Software Bill of Materials (SBOM) Standard. Retrieved 2023-08-14 from https:\/\/cyclonedx.org\/"},{"key":"e_1_3_2_1_37_1","volume-title":"Vulnerable Open Source Dependencies: Counting Those That Matter. In ACM\/IEEE International Symposium on Empirical Software Engineering and Measurement.","author":"Pashchenko Ivan","year":"2018","unstructured":"Ivan Pashchenko, Henrik Plate, Serena Elisa Ponta, Antonino Sabetta, and Fabio Massacci. 2018. Vulnerable Open Source Dependencies: Counting Those That Matter. In ACM\/IEEE International Symposium on Empirical Software Engineering and Measurement."},{"key":"e_1_3_2_1_38_1","volume-title":"Software Bills of Materials for IoT and OT devices","author":"Phillips Amas","year":"2023","unstructured":"Amas Phillips, Carsten Maple, Florian Lukavsky, Ian Pearson, Michael Richardson, Nigel Hanson, Paul Kearney, and Robert Dobson. 2023. Software Bills of Materials for IoT and OT devices. IoT Security Foundation (2023)."},{"key":"e_1_3_2_1_39_1","volume-title":"Valentina Hlebec, and Vasja Vehovar.","author":"Reja Ur\u0161a","year":"2003","unstructured":"Ur\u0161a Reja, Katja Lozar Manfreda, Valentina Hlebec, and Vasja Vehovar. 2003. Open-ended vs. close-ended questions in web questionnaires. Developments in applied statistics 19, 1 (2003), 159--177."},{"key":"e_1_3_2_1_40_1","unstructured":"Paul Roberts. 2021. Log4j is why you need a software bill of materials (SBOM). Retrieved 2023-07-26 from https:\/\/www.reversinglabs.com\/blog\/log4j-is-why-you-need-an-sbom"},{"key":"e_1_3_2_1_41_1","unstructured":"Ax Sharma. 2023. PyTorch discloses malicious dependency chain compromise over holidays. Retrieved 2023-08-01 from https:\/\/www.bleepingcomputer.com\/news\/security\/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays"},{"key":"e_1_3_2_1_42_1","volume-title":"IEEE\/ACM 46th International Conference on Software Engineering. 506--518","author":"Stalnaker Trevor","year":"2024","unstructured":"Trevor Stalnaker, Nathan Wintersgill, Oscar Chaparro, Massimiliano Di Penta, Daniel German, and Denys Poshyvanyk. 2024. BOMs Away! Inside the Minds of Stakeholders: A Comprehensive Study of Bills of Materials for Software Systems. In IEEE\/ACM 46th International Conference on Software Engineering. 506--518."},{"key":"e_1_3_2_1_43_1","unstructured":"Danny Steed and Robert Black. 2023. MOVEit Hack: Attack on BBC and BA Offers Glimpse into the Future of Cybercrime. Retrieved 2023-07-26 from https:\/\/theconversation.com\/moveit-hack-attack-on-bbc-and-ba-offers-glimpse-into-the-future-of-cybercrime-207670"},{"key":"e_1_3_2_1_44_1","unstructured":"Eric Tooley and Courtney Claessens. 2023. Introducing self-service SBOMs. Retrieved 2023-08-11 from https:\/\/github.blog\/2023-03-28-introducing-self-service-sboms\/"},{"key":"e_1_3_2_1_45_1","volume-title":"Determinants of perceived ease of use: Integrating control, intrinsic motivation, and emotion into the technology acceptance model. Information systems research 11, 4","author":"Venkatesh Viswanath","year":"2000","unstructured":"Viswanath Venkatesh. 2000. Determinants of perceived ease of use: Integrating control, intrinsic motivation, and emotion into the technology acceptance model. Information systems research 11, 4 (2000), 342--365."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"crossref","first-page":"98","DOI":"10.1109\/MC.2021.3075412","article-title":"Struggling With Supply-Chain Security","volume":"54","author":"Viega John","year":"2021","unstructured":"John Viega and James Bret Michael. 2021. Struggling With Supply-Chain Security. Computer 54, 7 (2021), 98--104.","journal-title":"Computer"},{"key":"e_1_3_2_1_47_1","volume-title":"On the Feasibility of Detecting Software Supply Chain Attacks. In IEEE Military Communications Conference. 458--463","author":"Wang Xinyuan","year":"2021","unstructured":"Xinyuan Wang. 2021. On the Feasibility of Detecting Software Supply Chain Attacks. In IEEE Military Communications Conference. 458--463."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1016\/0024-6301(82)90120-0"},{"key":"e_1_3_2_1_49_1","unstructured":"Free Wortley Chris Thompson and Forrest Allison. 2021. Log4Shell: RCE 0-day exploit found in log4j a popular Java logging package. Retrieved 2023-08-01 from https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/"},{"key":"e_1_3_2_1_50_1","volume-title":"An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead. In IEEE\/ACM International Conference on Software Engineering. 2630--2642","author":"Xia Boming","year":"2023","unstructured":"Boming Xia, Tingting Bi, Zhenchang Xing, Qinghua Lu, and Liming Zhu. 2023. An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead. In IEEE\/ACM International Conference on Software Engineering. 2630--2642."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3237100"},{"key":"e_1_3_2_1_52_1","volume-title":"ACM International Systems and Software Product Line Conference. 154--163","author":"Zajdel Stan","year":"2022","unstructured":"Stan Zajdel, Diego Elias Costa, and Hafedh Mili. 2022. Open Source Software: An Approach to Controlling Usage and Risk in Application Ecosystems. In ACM International Systems and Software Product Line Conference. 154--163."},{"key":"e_1_3_2_1_53_1","unstructured":"Kim Zetter. 2023. The Untold Story of the Boldest Supply-Chain Hack Ever. Retrieved 2023-08-18 from https:\/\/www.wired.com\/story\/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever\/"}],"event":{"name":"ASIA CCS '24: 19th ACM Asia Conference on Computer and Communications Security","location":"Singapore Singapore","acronym":"ASIA CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 19th ACM Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3634737.3637659","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T23:44:06Z","timestamp":1750290246000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3634737.3637659"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7]]},"references-count":53,"alternative-id":["10.1145\/3634737.3637659","10.1145\/3634737"],"URL":"https:\/\/doi.org\/10.1145\/3634737.3637659","relation":{},"subject":[],"published":{"date-parts":[[2024,7]]},"assertion":[{"value":"2024-07-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}