INSRE fosters applied research that is enhancing national security, defense, cybersecurity, intelligence gathering, and response capabilities.

Our Big 8 Research Capabilities

Optics and Photonics

Phontonics MSU

Quantum Advanced Applied Materials

quantum research

 

System Engineering and Prototyping

MT Mass Spec

Cybersecurity

cyber secuity exercise

 

Cube-Satellite Platforms

cube sat

Information Assurance & Data Science

Assurance & Data Science

 

Materials Engineering & Characterization

ARL Building

Experimental Mechanics and Diagnostics

experimental mechanics and diagnostics

 

Facilities & Capabilities

Research Centers & Lab Partners

Student Research Examples

Cyber Security Lab 

Eric O'Donoghue

Title: Analysis of Software Bill of Materials Compliance/Quality and Software Supply Chain Security Quality Using Hierarchical Quality Models

With the reliance on software across industries, ensuring the security and quality of software components in software supply chains has become a critical concern for software providers. Software Bill of Materials (SBOM) is an emerging technology that provides an inventory of all software components used in a particular application or system. This thesis addresses two facets of SBOM technology: quality of software bills of materials in their current state and the application of SBOMs as a tool for performing security quality analysis on software supply chains.


Our first research goal is to improve software providers ability in assessing both compliance to government standards and quality of software bills of materials. We accomplished this goal by developing and validating a hierarchical quality model, name tbd, to evaluate the quality of software bills of materials. Our second goal is to improve providers ability in assessing software supply chain security quality utilizing SBOM technology. We accomplished this goal by developing and validating a hierarchical security quality model, PIQUE-SBOM-SUPPLYCHAIN-SEC, to evaluate the security quality of third-party libraries and packages present in software. While there are existing tools that can be used to measure SBOM quality or software supply chain security, the use of a model is beneficial in both these cases as it integrates multiple analysis tools to have a better coverage of quality and security issues, utilizes existing quality standards, improves scoring accuracy via benchmarking a large corpus of SBOMs, and finally the aggregation of findings upward into a broader quality and security context.