Abstract:In recent years, software supply chain security has attracted significant research attention. This research subject is concerned both with the security of infrastructures used to build software and deliver it to end users and with the security of software that contains external dependencies such as third-party packages and libraries, and its chief goal is to ensure that no vulnerabilities are introduced in the path between developers and users. This paper presents a Systematic Literature Review to identify knowledge gaps in software supply chain security. For this, we considered studies published between 2012 and 2023 in the search engines of IEEE Xplore, ACM Digital Library, Engineering Village, Scopus, and arXiv. Of the 2051 studies obtained in the primary survey, only 85 are relevant for this research. Analyzing the studies, we observed gaps such as little discussion of software supply chains that involve cloud components, few proposals focused on the software distribution process, and a lack of use of threat modeling frameworks to help identify threats to the supply chain and validate the results.

Towards an Analysis of Software Supply Chain Risk Management

Risk Analysis and Control in Software Development

Understanding vulnerabilities in software supply chains

Risk Management of Supply Chains Based on Systems Analysis Method

Software supply chain: review of attacks, risk assessment strategies and security controls

Understanding and managing supply chain risk

What is Software Supply Chain Security?

An Analysis of Supply-chain Classification,Vulnerability and Management Method

Research on the Vulnerability of Supply Chain Based on Complexity

Study on analysis and countermeasures for present status of risk management in chinese software industry

Software Supply-Chain Security: Issues and Countermeasures

Software supply chain security: a systematic literature review

Software Supply Chain Analysis Based on Function Similarity

Research Summary of Supply Chain Risk Management Based on Complex Network Theory

SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties

Enhancing Software Supply Chain Resilience: Strategy For Mitigating Software Supply Chain Security Risks And Ensuring Security Continuity In Development Lifecycle

Construction of Software Supply Chain Threat Portrait Based on Chain Perspective

Analysis and Evaluation on Supply Chain Risks for B2B E-commerce Enterprises

Construction Supply Chain Risks Identifying and Control Policies

Review and Reseavch on the Risk of Supply Chain Network