S3C2 Summit 2025-03: Industry Secure Supply Chain Summit

2025-10-28

AI Summary

Software supply chain security has emerged as a critical risk vector for essential infrastructure, with vulnerabilities increasingly exploited in large-scale attacks. To address this, this project convened 18 practitioners from government, industry, academia, and civil society—producing the first systematic integration of multi-stakeholder perspectives. Through structured workshops and open-ended Q&A sessions, six core challenges were identified: SBOM governance, build infrastructure hardening, malicious commit detection, compliance automation, organizational security culture, and secure LLM adoption. The resulting cross-sectoral practice map clarifies prevailing technical bottlenecks and research gaps across these domains. This work delivers empirically grounded research directions for academia, while providing policymakers and enterprise security teams with an actionable, implementation-ready framework. Collectively, it advances the field’s evolution from fragmented incident response toward holistic, systemic governance of software supply chain security.

Technology Category

• Constraint Satisfaction and Optimization: Solvers and Tools
• Application Domains: Security
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems

Application Category

• Security and Privacy: Data transparency and provenance
• Systems and Infrastructure for Web, Mobile and WoT: Web applications in cross-disciplinary domains and verticals such as mixed reality, smart cities, and digital health
• Responsible Web: Consent frameworks and practices on the web

Abstract

Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks specifically targeting vulnerable links in critical software supply chains. These attacks disrupt the day-to-day functioning and threaten the security of nearly everyone on the internet, from billion-dollar companies and government agencies to hobbyist open-source developers. The ever-evolving threat of software supply chain attacks has garnered interest from both the software industry and US government in improving software supply chain security. On Thursday, March 6th, 2025, four researchers from the NSF-backed Secure Software Supply Chain Center (S3C2) conducted a Secure Software Supply Chain Summit with a diverse set of 18 practitioners from 17 organizations. The goals of the Summit were: (1) to enable sharing between participants from different industries regarding practical experiences and challenges with software supply chain security; (2) to help form new collaborations; and (3) to learn about the challenges facing participants to inform our future research directions. The summit consisted of discussions of six topics relevant to the government agencies represented, including software bill of materials (SBOMs); compliance; malicious commits; build infrastructure; culture; and large language models (LLMs) and security. For each topic of discussion, we presented a list of questions to participants to spark conversation. In this report, we provide a summary of the summit. The open questions and challenges that remained after each topic are listed at the end of each topic's section, and the initial discussion questions for each topic are provided in the appendix.

Problem

• Addressing cybersecurity threats targeting software supply chain vulnerabilities
• Improving software supply chain security through industry collaboration and research
• Identifying challenges in SBOMs, compliance, and infrastructure for supply chains

Innovation

• Conducted multi-stakeholder summit for security collaboration
• Discussed software bill of materials and compliance frameworks
• Explored malicious commits and build infrastructure protection