Skip to content

An Industry Interview Study of Software Signing for Supply Chain Security#

USENIX Security '25 (34th USENIX Security Symposium) digest Program Adjacent pick 13–15 August 2025

Recording

Kelechi G. Kalu et al., Purdue University — Adjacent

Play the recording: An Industry Interview Study of Software Signing for Supply Chain Security

  • Why: Software signing is widely recommended by supply-chain security frameworks but adoption remains low — this is the first in-depth practitioner account of why, complementing the technical PKI/cert-validation picks above with the human/organizational side.
  • What: Interviews with 18 experienced security practitioners across 13 organizations on software-signing adoption, surfacing technical, organizational, and human barriers; finds experts disagree on signing's importance and documents how internal/external events (breaches, new regulation) drive adoption. (from abstract only)
  • How: Qualitative interview study producing a refined software-supply-chain factory model highlighting where and why signing practices break down. (from abstract only)
  • Where applicable: General for organizations evaluating or mandating software signing as part of supply-chain security policy.