An Industry Interview Study of Software Signing for Supply Chain Security

Explore an industry interview study examining software signing practices for supply chain security through research conducted with 18 experienced security practitioners across 13 organizations. Learn about the challenges affecting effective implementation of software signing in practice, including technical, organizational, and human factors that hamper adoption. Discover a refined model of the software supply chain factory highlighting practitioner signing practices, and understand how experts disagree on the importance of signing despite cybersecurity frameworks and regulations recommending its use. Examine the impact of experienced software supply chain failures, security standards, and regulations on software signing adoption, and gain insights into how internal and external events influence the adoption of software signing as part of broader software supply chain security goals. Understand the considerations for implementing software signing based on real-world industry perspectives and practices gathered through comprehensive interviews with security professionals.